{ "Event": { "analysis": "1", "date": "2026-07-07", "extends_uuid": "", "info": "[Threat Intel] Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation", "protected": false, "publish_timestamp": "1784349315", "published": true, "threat_level_id": "3", "timestamp": "1784349314", "uuid": "b6e2041e-b569-4d1d-912b-8556d5737e7d", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0afe32", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#57b2ae", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#50bcaa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Lumma Stealer\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Vidar\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"xmrig\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652423", "to_ids": false, "type": "link", "uuid": "602c16ea-f2ea-412a-9a12-cb40cfa14b83", "value": "https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783652423", "to_ids": false, "type": "text", "uuid": "a3603374-104a-4f9e-851c-6f39279378ea", "value": "A financially motivated campaign identified in April 2026 delivers Vidar stealer and XMRig cryptocurrency miner to victims worldwide through malvertising. Attackers distribute password-protected archives impersonating cracked software, using Go-compiled loaders built with the Factory-v3 framework. The malware employs sophisticated evasion techniques including rogue Authenticode certificates mimicking JustWatch and BleacherReport, file-size inflation to hundreds of MB with null bytes, and AMSI bypass. Once executed, Vidar stealer exfiltrates browser credentials, cookies and cryptocurrency wallets to C2 infrastructure, while XMRig mines Monero cryptocurrency. The operation establishes persistence through registry modifications, scheduled tasks and startup folder scripts. The threat actor, operating under the moniker X3D MINER, primarily targets victims in the U.S. and European Union through a dual-monetization scheme combining credential theft and cryptojacking." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783652423", "to_ids": false, "type": "text", "uuid": "13531164-b575-46cf-a5c8-f69c1f6b1b7a", "value": "Name: Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation\nAuthor: AlienVault\nAdversary: X3D MINER\nTags: [\"vidar stealer\", \"cryptojacking\", \"vidar\", \"amsi bypass\", \"xmrig\", \"go loader\", \"credential theft\", \"factory-v3\", \"code signing abuse\", \"malvertising\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"Vidar\", \"XMRig\"]\nAttack_ids: [\"T1053.005\", \"T1082\", \"T1005\", \"T1140\", \"T1555\", \"T1036\", \"T1055\", \"T1112\", \"T1083\", \"T1497\", \"T1204\", \"T1057\", \"T1041\", \"T1547.001\", \"T1027\", \"T1496\", \"T1189\", \"T1071.001\", \"T1518\", \"T1574.002\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783652423", "to_ids": false, "type": "threat-actor", "uuid": "25825c42-9d0f-4adc-a7ac-edd0257f85fd", "value": "X3D MINER" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344512", "to_ids": true, "type": "md5", "uuid": "6d0ee01b-8764-4381-95a1-d131326cd278", "value": "d42595b695fc008ef2c56aabd8efd68e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344513", "to_ids": true, "type": "md5", "uuid": "6d9eee9b-9781-4414-9ed5-d1b88c747b69", "value": "1aae8bf580c846f39c71c05898e57e88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344514", "to_ids": true, "type": "md5", "uuid": "52866e4d-0116-4cbc-8c96-32391394e1a0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS24940 hetzner online gmbh", "deleted": false, "disable_correlation": false, "timestamp": "1784345505", "to_ids": true, "type": "ip-dst", "uuid": "ec369de1-d942-48f6-ab52-1b75b73044e0", "value": "136.243.203.109", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1784345526", "to_ids": true, "type": "ip-dst", "uuid": "30a536f6-5c2d-4abe-96d0-348329c288c4", "value": "138.199.246.13", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS24940 hetzner online gmbh", "deleted": false, "disable_correlation": false, "timestamp": "1784345548", "to_ids": true, "type": "ip-dst", "uuid": "5aa3b49e-3cf4-40f1-b4e8-1b29f258f6f5", "value": "136.243.203.111", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS24940 hetzner online gmbh", "deleted": false, "disable_correlation": false, "timestamp": "1784345569", "to_ids": true, "type": "ip-dst", "uuid": "0be8f3c0-ac68-4372-8a0d-b141558e4fb6", "value": "116.203.243.208", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344514", "to_ids": true, "type": "md5", "uuid": "6173e08f-9fab-4d50-b160-eed33c8bcc98", "value": "c10333c92889b65c3590ef2b3819b420", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344515", "to_ids": true, "type": "sha1", "uuid": "a8330577-6698-4b79-b609-af9ab367f923", "value": "ab92f731ab20774dfdb95664ee41a2fbafe2a284", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344516", "to_ids": true, "type": "sha256", "uuid": "b7b4fd4f-63f4-4f05-a67e-60f05afcb676", "value": "5838ae6c748dcbdfa13c6529c654cb821897d29835d3e7e05ca23fb2f3794f02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344517", "to_ids": true, "type": "sha256", "uuid": "36dd50eb-f1e0-48f5-90a4-9b1c07eb8d96", "value": "69946018ddda1058ce5c2a556c78a747838865c47074dcb165effb0840cb1cf5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784333235", "to_ids": true, "type": "filename", "uuid": "9df72d18-b57d-4966-b5a1-dbe185fa8da7", "value": "MpClient.dll" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345590", "uuid": "be00888f-00b6-4cfa-b607-83cefc35dd1c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "md5", "timestamp": "1784345590", "to_ids": true, "type": "md5", "uuid": "3ff43301-65b8-4704-9c35-992874fc9542", "value": "8cb8301f664e1e42dee8b7032fa321fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "sha1", "timestamp": "1784344390", "to_ids": true, "type": "sha1", "uuid": "baf65c9d-cbbe-4030-958e-e7f95b266c2f", "value": "f732e938a8fda479886576df82c611f9540db42c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "sha256", "timestamp": "1784344390", "to_ids": true, "type": "sha256", "uuid": "952b6ab3-bc7b-4c35-89d3-2926f6fb5667", "value": "03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "text", "timestamp": "1784339156", "to_ids": false, "type": "text", "uuid": "7aaa5b54-7096-4965-88bb-43f5a1bdee5e", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/LummaStealer.GXM!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Seen In The Wild: 2026-04-15T16:56:42+00:00\nFirst Submission: 2026-04-15T17:24:58+00:00\nLast Submission: 2026-04-15T19:24:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "ssdeep", "timestamp": "1784339156", "to_ids": true, "type": "ssdeep", "uuid": "83e3692a-486b-4d44-96d7-1cbc8b5545f6", "value": "24576:ew48NqvO9qOoJQ/LEMC16tzKJt1rROu/3srGurkU+zE7WdUGYV5LWJfINPsb3gWH:elCY8tzc7qEDbQWH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339156", "to_ids": false, "type": "size-in-bytes", "uuid": "22cd2b4c-5e63-4c4e-b1e0-74442d932e64", "value": "1762432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "vhash", "timestamp": "1784339156", "to_ids": true, "type": "vhash", "uuid": "70475f13-4832-4fe4-94e4-8417cc591ef7", "value": "016076656d1d1564557az2c!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:24:58+00:00", "last_seen": "2026-04-15T19:24:14+00:00", "object_relation": "filename", "timestamp": "1784339156", "to_ids": true, "type": "filename", "uuid": "c46fea25-0c03-4ebe-a166-0447498a7b04", "value": "03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345612", "uuid": "010a93dc-4efb-4b58-8d94-27b29d4733ce", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "md5", "timestamp": "1784345612", "to_ids": true, "type": "md5", "uuid": "f3d8c1e3-0d6f-4d86-84fe-163c41e24a94", "value": "6c1342bbc4017ab1cc3eb8fe5d356c87", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "sha1", "timestamp": "1784344391", "to_ids": true, "type": "sha1", "uuid": "5f08037a-4a8a-4d92-a36c-9a4be1bd3eec", "value": "982c22670b380ade0f58ef486b9a3a659ec190dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "sha256", "timestamp": "1784344391", "to_ids": true, "type": "sha256", "uuid": "30fd29da-0cfd-443a-8035-9c29d135432d", "value": "6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "text", "timestamp": "1784339178", "to_ids": false, "type": "text", "uuid": "2783640b-232f-4fa2-9390-e046c3481c22", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-15T19:21:12+00:00\nFirst Submission: 2026-04-15T15:08:14+00:00\nLast Submission: 2026-04-16T03:52:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "ssdeep", "timestamp": "1784339178", "to_ids": true, "type": "ssdeep", "uuid": "460f9790-3220-4bf4-acb1-6eb09327d607", "value": "24576:ZcBLMy+RP4ln+QGYogVNEqsGzTw0/oqWVgKyWNn7mnjolRM2+NTBele5y92XUMi5:ZG4bRQlrLogDGDyeRryji5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339178", "to_ids": false, "type": "size-in-bytes", "uuid": "c1e20c44-a1d9-4ce3-b73b-4fdf56cc3b2f", "value": "2442368" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "vhash", "timestamp": "1784339178", "to_ids": true, "type": "vhash", "uuid": "2a2b6781-020c-4e21-af58-d9414b023d35", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:08:14+00:00", "last_seen": "2026-04-16T03:52:34+00:00", "object_relation": "filename", "timestamp": "1784339178", "to_ids": true, "type": "filename", "uuid": "e111dc9d-6445-4a0d-bf78-07ec521d1ed8", "value": "6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345633", "uuid": "ccdcbd88-99a0-4192-b5fe-f41518cb012f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "md5", "timestamp": "1784345633", "to_ids": true, "type": "md5", "uuid": "b2fec810-2daa-4945-b687-bed513b7a7af", "value": "033a49eb29d1ca3979757f3263ff6417", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "sha1", "timestamp": "1784344393", "to_ids": true, "type": "sha1", "uuid": "ca0aec17-8827-48d0-a6ed-5de29afaf63c", "value": "c14085a84c19a54cca4ee38615a1bcf6f166aefa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "sha256", "timestamp": "1784344393", "to_ids": true, "type": "sha256", "uuid": "0cf2e959-a1cc-4307-8dff-6c56069fb3ff", "value": "b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "text", "timestamp": "1784339199", "to_ids": false, "type": "text", "uuid": "6170b4b2-2ab9-419f-8f0d-763afa6d4494", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 53/74\nFirst Seen In The Wild: 2026-04-15T15:29:19+00:00\nFirst Submission: 2026-04-15T13:43:08+00:00\nLast Submission: 2026-04-18T01:22:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "ssdeep", "timestamp": "1784339199", "to_ids": true, "type": "ssdeep", "uuid": "ec3f7696-79ee-4502-8149-7554ea801e74", "value": "24576:zf1V4Bf+Um7tNi2ef8KeU2//zbDw7TGMBEgYVarLu3J4c7Fhele5n92yc6OHl:zf1SR+9tNiJ8J//zbc7TGMBErol" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339199", "to_ids": false, "type": "size-in-bytes", "uuid": "1ed2de5f-4f8a-46bd-a412-f0fd3769205f", "value": "2246784" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "vhash", "timestamp": "1784339199", "to_ids": true, "type": "vhash", "uuid": "fee1ef77-6273-4c43-a93a-5fea13d11419", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:43:08+00:00", "last_seen": "2026-04-18T01:22:08+00:00", "object_relation": "filename", "timestamp": "1784339199", "to_ids": true, "type": "filename", "uuid": "b65c0586-f2d3-4cbb-ae7f-98b879d82f3d", "value": "b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345655", "uuid": "cb62cca5-1f78-4390-99cd-f881785d5eea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "md5", "timestamp": "1784345655", "to_ids": true, "type": "md5", "uuid": "f5dcc73b-0a38-4709-92fd-9bd9657c5ce2", "value": "dc17d8e9f92d83ec92f9789f0f0d720d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "sha1", "timestamp": "1784344394", "to_ids": true, "type": "sha1", "uuid": "ab245bd1-24ad-4d9e-bcf0-5d09fb061b4d", "value": "cde90dbdbadc6abb4864f4ac1075e1f9d2085798", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "sha256", "timestamp": "1784344394", "to_ids": true, "type": "sha256", "uuid": "046d2076-4af5-40da-af99-87223f9b1b27", "value": "68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "text", "timestamp": "1784339220", "to_ids": false, "type": "text", "uuid": "0ed3c66f-460b-47a9-8d7b-fbd27b8f6da3", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 53/74\nFirst Seen In The Wild: 2026-04-16T10:33:09+00:00\nFirst Submission: 2026-04-16T10:55:00+00:00\nLast Submission: 2026-04-16T10:57:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "ssdeep", "timestamp": "1784339220", "to_ids": true, "type": "ssdeep", "uuid": "031771c9-2a31-4751-928b-cc012b44cc27", "value": "49152:HLtXjt52QNIIfX2P4Xqp5yp7HfqMWlQXVrSm4:HpXvuaX2Pyqp5ypzfqYXV/4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339220", "to_ids": false, "type": "size-in-bytes", "uuid": "f83babd1-effe-4fad-9fbd-9ae80c99d6e4", "value": "2218112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "vhash", "timestamp": "1784339220", "to_ids": true, "type": "vhash", "uuid": "d0c017f0-56cb-472c-b69d-ed67c517c0df", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:55:00+00:00", "last_seen": "2026-04-16T10:57:48+00:00", "object_relation": "filename", "timestamp": "1784339220", "to_ids": true, "type": "filename", "uuid": "0d6513b0-c0e7-4147-b8bc-86a8edf137a8", "value": "68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345676", "uuid": "2fcb2de4-b313-4f69-ae4a-3b97656d18cf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "md5", "timestamp": "1784345676", "to_ids": true, "type": "md5", "uuid": "1916b939-9cef-4d56-a5ba-b263e5df576a", "value": "de3c6dc21330f6c501ada99d2206e27f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "sha1", "timestamp": "1784344395", "to_ids": true, "type": "sha1", "uuid": "7f7f3411-038e-4911-b803-ea6e56d336d5", "value": "65f5161364a1a759cd48d3e3ae87231ef8665d26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "sha256", "timestamp": "1784344395", "to_ids": true, "type": "sha256", "uuid": "17019baf-788f-4148-a5db-05d3a6dca581", "value": "b9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "text", "timestamp": "1784339243", "to_ids": false, "type": "text", "uuid": "7cf50739-ec94-42c2-9d51-5f5d615276fc", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-16T01:38:20+00:00\nFirst Submission: 2026-04-15T19:48:27+00:00\nLast Submission: 2026-04-19T16:31:04+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "ssdeep", "timestamp": "1784339243", "to_ids": true, "type": "ssdeep", "uuid": "f10f7916-ebc4-41a3-97e8-dd4b6ae66554", "value": "24576:vHhOFhi5XVkw5fjzygB7MkyLLcG+np+MHx30yIKp1iXIxNtaiJH7Fhele5n92VGo:vHhUyXzjzygdmLLi+0np1iXyNrJHEesV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339243", "to_ids": false, "type": "size-in-bytes", "uuid": "a3bc9bec-8d82-4bb2-801d-de67cf39d92d", "value": "2599008" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "vhash", "timestamp": "1784339243", "to_ids": true, "type": "vhash", "uuid": "23d00dac-686d-4781-bdc4-fd758086306b", "value": "1261376d1565551c051d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T19:48:27+00:00", "last_seen": "2026-04-19T16:31:04+00:00", "object_relation": "filename", "timestamp": "1784339243", "to_ids": true, "type": "filename", "uuid": "bada040a-645f-4edc-9eec-b74d0d58ca9c", "value": "b9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345698", "uuid": "d131a5d8-8f7b-4ccb-ab55-4e001b4b4e0f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "md5", "timestamp": "1784345698", "to_ids": true, "type": "md5", "uuid": "c3a50995-682e-4ad8-86e3-501adb1991ac", "value": "6695ae857e67b6283d49c6531a253db6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "sha1", "timestamp": "1784344396", "to_ids": true, "type": "sha1", "uuid": "bc80a601-fcca-4a07-8358-8321c1255c46", "value": "d5f52f6b215444a98472a33dda156fa0f5484217", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "sha256", "timestamp": "1784344396", "to_ids": true, "type": "sha256", "uuid": "ad2f8975-81ec-486c-8650-29f5634c3a02", "value": "d6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "text", "timestamp": "1784339264", "to_ids": false, "type": "text", "uuid": "976ef0f7-a227-4d34-92a4-fb6b3e71fb4d", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-16T16:05:18+00:00\nFirst Submission: 2026-04-16T15:05:13+00:00\nLast Submission: 2026-07-03T10:30:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "ssdeep", "timestamp": "1784339264", "to_ids": true, "type": "ssdeep", "uuid": "202b2a1a-6361-490d-a872-9ad78a9ab224", "value": "24576:+7yxVZOkgdYzsFW6NjRoZ+gCQ5Po7OKFelHwfDU9WLJPFhele5n923cVsCsiNJ9i:+7w7Ok1sFWb+vQ5WOKA5wIKc2sCB9i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339264", "to_ids": false, "type": "size-in-bytes", "uuid": "f1054869-47a1-4e86-b378-dcf4823b1c16", "value": "2239104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "vhash", "timestamp": "1784339264", "to_ids": true, "type": "vhash", "uuid": "b7e5c410-1b98-4c1b-b842-fcff43cb878d", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:05:13+00:00", "last_seen": "2026-07-03T10:30:23+00:00", "object_relation": "filename", "timestamp": "1784339264", "to_ids": true, "type": "filename", "uuid": "0607d1f8-fd16-4ce0-ae11-f789a7a0095f", "value": "d6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345719", "uuid": "d98a3551-d28f-4bf3-9c36-577be4767d0b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "md5", "timestamp": "1784345719", "to_ids": true, "type": "md5", "uuid": "61210aa0-3a82-489e-b343-02b2aac6a01a", "value": "fcbfd86c521e2ffc2dd58a2a58927921", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "sha1", "timestamp": "1784344397", "to_ids": true, "type": "sha1", "uuid": "cd999a74-949f-485f-ae1a-cb6dad18da93", "value": "1a5c6798b26ec4c58e3699223b59a65915c66d44", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "sha256", "timestamp": "1784344397", "to_ids": true, "type": "sha256", "uuid": "c7aaf63e-04ff-496c-baaa-0a7be68ff014", "value": "74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "text", "timestamp": "1784339285", "to_ids": false, "type": "text", "uuid": "c3d22548-b0a1-4569-b45b-9bf5fb6de90c", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 51/74\nFirst Submission: 2026-04-16T15:57:48+00:00\nLast Submission: 2026-04-24T17:17:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "ssdeep", "timestamp": "1784339285", "to_ids": true, "type": "ssdeep", "uuid": "3d9c2d8f-dc09-4a1b-84ee-91278fc71301", "value": "24576:2u8/vVX3awuqts1xX3N5++Y7Pcp7tqeK6coC1bOBSjPFhele5n923cZD3MR:2uoNX3zts1ccNMeK6cLaSfcUy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339285", "to_ids": false, "type": "size-in-bytes", "uuid": "11ddcbdc-ddf6-427a-a637-54ecfabac1d8", "value": "1803904" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "vhash", "timestamp": "1784339285", "to_ids": true, "type": "vhash", "uuid": "d95fc28b-0d6d-45f1-8bbe-3f36363d274b", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:57:48+00:00", "last_seen": "2026-04-24T17:17:21+00:00", "object_relation": "filename", "timestamp": "1784339285", "to_ids": true, "type": "filename", "uuid": "1d4d060e-0392-40a4-84d6-f20a0a07352b", "value": "?????.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345740", "uuid": "e15070b7-dd68-423c-a56f-66fe3319a78a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "md5", "timestamp": "1784345740", "to_ids": true, "type": "md5", "uuid": "db580a04-e2ee-49b0-966e-805ee47b72d2", "value": "99775c9078774ed124e37d089334de5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "sha1", "timestamp": "1784344398", "to_ids": true, "type": "sha1", "uuid": "6f16630a-43c3-4b70-b3f3-caf3df01b1f5", "value": "1fe42725e5471a3f365a1180f798946643924d3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "sha256", "timestamp": "1784344398", "to_ids": true, "type": "sha256", "uuid": "6ea2f210-9399-4314-b9cf-74701e0ad463", "value": "b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "text", "timestamp": "1784339307", "to_ids": false, "type": "text", "uuid": "2ae8ef3e-195e-4b9f-a57b-a8a969a2e381", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.ITW!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-16T22:44:04+00:00\nFirst Submission: 2026-04-16T17:58:29+00:00\nLast Submission: 2026-04-21T16:04:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "ssdeep", "timestamp": "1784339307", "to_ids": true, "type": "ssdeep", "uuid": "81a8ca4a-6506-4b69-918c-cdce759297b5", "value": "49152:IPQHj50PVTn9V6YYgeIDIWSKPzZ5I+ZsU:IYYL9V6Y9etWSKrYqsU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339307", "to_ids": false, "type": "size-in-bytes", "uuid": "0a90fcea-8609-42bd-8df1-2cbece011ff4", "value": "2613872" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "vhash", "timestamp": "1784339307", "to_ids": true, "type": "vhash", "uuid": "6c9917d8-36b6-4aeb-ae58-7b7f8ee083e4", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T17:58:29+00:00", "last_seen": "2026-04-21T16:04:57+00:00", "object_relation": "filename", "timestamp": "1784339307", "to_ids": true, "type": "filename", "uuid": "2329cf27-d283-4e4e-beaf-c11de1564e5a", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345761", "uuid": "b4213034-b7fd-41c3-8374-605cee74732e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "md5", "timestamp": "1784345761", "to_ids": true, "type": "md5", "uuid": "b16757a6-4604-4e5c-bdf0-d0c13e0f337a", "value": "eca863e5c96a59267878e4f9a7e32b46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "sha1", "timestamp": "1784344399", "to_ids": true, "type": "sha1", "uuid": "e4080248-6361-408b-b058-c61cb95b35cd", "value": "ddd6edbf5431b814e6793d9c2ccd0d3b3d8efa8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "sha256", "timestamp": "1784344399", "to_ids": true, "type": "sha256", "uuid": "c8c1de41-1aae-4022-86a1-eb290e16a55e", "value": "95cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "text", "timestamp": "1784339328", "to_ids": false, "type": "text", "uuid": "692365f4-f343-4402-9cf9-0b2ca1648b43", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Seen In The Wild: 2026-04-22T21:03:29+00:00\nFirst Submission: 2026-04-22T18:41:00+00:00\nLast Submission: 2026-04-23T09:32:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "ssdeep", "timestamp": "1784339328", "to_ids": true, "type": "ssdeep", "uuid": "edecb8b9-bdb9-4482-8341-3e69e2ee1770", "value": "24576:OLwM/JkDsu4XBEiTYtPLaXhdCeGGK64XY23+/W+M0yDMwY8o7TZn2zKptGEDXTzw:O0ykDeEiTlwhXY2u//L8qTZn/p54" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339328", "to_ids": false, "type": "size-in-bytes", "uuid": "e8ecb0de-a7fe-40b0-a259-50f63e2add17", "value": "2621640" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "vhash", "timestamp": "1784339328", "to_ids": true, "type": "vhash", "uuid": "75947969-225b-4d32-b6d9-244f6a2d750d", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:41:00+00:00", "last_seen": "2026-04-23T09:32:42+00:00", "object_relation": "filename", "timestamp": "1784339328", "to_ids": true, "type": "filename", "uuid": "1b3ebf44-df39-497e-9622-68f694915b22", "value": "95cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345783", "uuid": "672f9a7e-f167-497b-b25e-9f9b7b191f09", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "md5", "timestamp": "1784345783", "to_ids": true, "type": "md5", "uuid": "34d4cf50-3923-4e28-bb2c-131e1dbb29ee", "value": "a30418484257d640e670af047d8f7bca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "sha1", "timestamp": "1784344401", "to_ids": true, "type": "sha1", "uuid": "62169b5a-028c-4427-882c-2af88bed7388", "value": "86e9cc2ae1e4f9366cee2377a8f5e60e076d1df2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "sha256", "timestamp": "1784344401", "to_ids": true, "type": "sha256", "uuid": "b79f7400-fe16-45f7-9616-d21be2d2434d", "value": "613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "text", "timestamp": "1784339350", "to_ids": false, "type": "text", "uuid": "d24474e4-39f9-4ec6-a674-3776b6a7cba6", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-23T05:19:43+00:00\nFirst Submission: 2026-04-22T19:30:24+00:00\nLast Submission: 2026-04-23T05:19:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "ssdeep", "timestamp": "1784339350", "to_ids": true, "type": "ssdeep", "uuid": "3b4fc8cd-5a96-4f19-8000-cd949b9465da", "value": "49152:AbDPy8HmG8egkAoJwbwS8CvdOOZKJlBbVtlhs4:AF4sJvHs4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339350", "to_ids": false, "type": "size-in-bytes", "uuid": "ac0327f1-6612-402e-ad51-5fa18423e77a", "value": "2391560" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "vhash", "timestamp": "1784339350", "to_ids": true, "type": "vhash", "uuid": "35bdabd7-a760-4d7e-b6a0-403e7a8d1d40", "value": "1261376d1565551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T19:30:24+00:00", "last_seen": "2026-04-23T05:19:43+00:00", "object_relation": "filename", "timestamp": "1784339350", "to_ids": true, "type": "filename", "uuid": "9aaf2670-335d-4960-9734-a2c3623a1326", "value": "613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345804", "uuid": "f84a3932-96e4-45b1-b44a-245b9293e4e2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "md5", "timestamp": "1784345804", "to_ids": true, "type": "md5", "uuid": "d00c9181-5198-4764-b898-615428f4da67", "value": "4d40d9c6445cb096f24bbca6862042a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "sha1", "timestamp": "1784344402", "to_ids": true, "type": "sha1", "uuid": "3188d28c-0d60-4de0-b98c-8fc5812b28bb", "value": "6d4242a4819ea8a58ea362056f4034d408da01f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "sha256", "timestamp": "1784344402", "to_ids": true, "type": "sha256", "uuid": "d856ff21-291b-4803-b89a-ec320ca4d8d4", "value": "8dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "text", "timestamp": "1784339371", "to_ids": false, "type": "text", "uuid": "5ed1bd90-3ee8-41b8-a8b0-257a9e663bbd", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-24T04:42:13+00:00\nFirst Submission: 2026-04-23T11:19:28+00:00\nLast Submission: 2026-04-24T04:42:12+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "ssdeep", "timestamp": "1784339371", "to_ids": true, "type": "ssdeep", "uuid": "b0ca8cca-71ce-4e21-be7b-926a44c7040b", "value": "49152:vlIHziPTUFYBWCS1PQqElvkZAYbIbUgJRAldxsTp:vjuJbsN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339371", "to_ids": false, "type": "size-in-bytes", "uuid": "0ea8ceaf-e2c9-4e38-b26a-ad6ff908bf44", "value": "2394120" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "vhash", "timestamp": "1784339371", "to_ids": true, "type": "vhash", "uuid": "2e170663-6bbc-49e3-b974-3534e0356b34", "value": "1261376d1565551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:19:28+00:00", "last_seen": "2026-04-24T04:42:12+00:00", "object_relation": "filename", "timestamp": "1784339371", "to_ids": true, "type": "filename", "uuid": "2c98c1e0-e6a0-4293-b7bc-17376e4a3ce5", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345825", "uuid": "eb670c1b-6997-491f-8583-f7c6a47f7402", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "md5", "timestamp": "1784345825", "to_ids": true, "type": "md5", "uuid": "da63b8e4-b5e5-43b7-b3d7-1a3ce9fde1ff", "value": "93a1a33e92f6d4684f231012f1d5872c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "sha1", "timestamp": "1784344403", "to_ids": true, "type": "sha1", "uuid": "662a39f2-854b-4998-b29b-706a3b222de6", "value": "888dbcd7033ff84ead51d2e7d5397f0e9632ef96", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "sha256", "timestamp": "1784344403", "to_ids": true, "type": "sha256", "uuid": "eab7f222-46c3-42ae-8c29-c5a678ab7753", "value": "634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "text", "timestamp": "1784339393", "to_ids": false, "type": "text", "uuid": "efc5cbd3-1e1e-47ff-b8b0-076388f79e42", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Submission: 2026-04-23T12:23:52+00:00\nLast Submission: 2026-04-23T17:19:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "ssdeep", "timestamp": "1784339393", "to_ids": true, "type": "ssdeep", "uuid": "541f8d8d-0615-40c0-8430-ca53d44baaf5", "value": "49152:bPE+OIaSlC05Alg0PBnQLPncyrkkgI6gNnn9IOa5:bPEkR45Ee5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339393", "to_ids": false, "type": "size-in-bytes", "uuid": "3a0ebb86-44e9-4850-9e4f-e3ab3859acf8", "value": "1967816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "vhash", "timestamp": "1784339393", "to_ids": true, "type": "vhash", "uuid": "e3775097-fcd6-4f3a-890b-26e2fdadbd53", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T12:23:52+00:00", "last_seen": "2026-04-23T17:19:55+00:00", "object_relation": "filename", "timestamp": "1784339393", "to_ids": true, "type": "filename", "uuid": "dcf998db-fe19-4897-b0c1-080cd1583949", "value": "634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b91.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345846", "uuid": "b31af1d8-dec0-47c3-b99a-86f415db8845", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "md5", "timestamp": "1784345846", "to_ids": true, "type": "md5", "uuid": "22236ee2-bb3b-42a5-91f2-c783526bd80b", "value": "92926805ef829d33fb290c44a4f7dd26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "sha1", "timestamp": "1784344404", "to_ids": true, "type": "sha1", "uuid": "fbd2b9f5-5ef6-40f9-a390-e093b09d19c7", "value": "5131e320f190f796f73a4553d30ce24586c27976", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "sha256", "timestamp": "1784344404", "to_ids": true, "type": "sha256", "uuid": "342c03ea-9648-4943-a6f9-814746d51c00", "value": "6d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b217226", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "text", "timestamp": "1784339415", "to_ids": false, "type": "text", "uuid": "0634b708-0fc4-44cd-bd81-1510450cc8e5", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-23T22:11:01+00:00\nFirst Submission: 2026-04-23T21:10:55+00:00\nLast Submission: 2026-05-15T19:00:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "ssdeep", "timestamp": "1784339415", "to_ids": true, "type": "ssdeep", "uuid": "625ccc8d-7d1c-4a69-8226-d16dd9481fba", "value": "49152:njztIJxZbgm5qkp8ftDW417JOc48cSS0fPsxBWEOiPmdJOVm:n4gXpvDsxB/m" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339415", "to_ids": false, "type": "size-in-bytes", "uuid": "0812356f-36bf-4fae-898e-3ca589fdd8a5", "value": "2383560" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "vhash", "timestamp": "1784339415", "to_ids": true, "type": "vhash", "uuid": "41ba99f4-5d63-4610-bd3d-a2355cddf1f9", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T21:10:55+00:00", "last_seen": "2026-05-15T19:00:26+00:00", "object_relation": "filename", "timestamp": "1784339415", "to_ids": true, "type": "filename", "uuid": "8dead51a-22ea-4758-89d3-4270c7aaa1a0", "value": "6d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b217226.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345867", "uuid": "839ee494-14b0-4c4d-887d-f3df15cccfc4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "md5", "timestamp": "1784345867", "to_ids": true, "type": "md5", "uuid": "b09d788b-645c-4788-9b4c-939fe88c2977", "value": "5db0608a66cef819136edf61c458a119", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "sha1", "timestamp": "1784344406", "to_ids": true, "type": "sha1", "uuid": "74465b3d-5c34-49ca-9bd5-7224f58be395", "value": "1bef5afa1b80633e5cad4bb56d6e93dc915139eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "sha256", "timestamp": "1784344406", "to_ids": true, "type": "sha256", "uuid": "116c779e-1835-4f42-baa0-0fd49fdfa32f", "value": "3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "text", "timestamp": "1784339436", "to_ids": false, "type": "text", "uuid": "8438475b-a733-4f40-9fcb-16055c580ff3", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/LummaStealer.GXM!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-04-23T06:53:08+00:00\nLast Submission: 2026-04-23T06:53:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "ssdeep", "timestamp": "1784339436", "to_ids": true, "type": "ssdeep", "uuid": "c75d0a1a-d46d-4894-95bc-86ca9baee69c", "value": "49152:SZqw2J5kxP1l4mL05qizL3gtpbodOK3T57E8oE:CxPc6KNzL3gLbodOK3T57E8oE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339436", "to_ids": false, "type": "size-in-bytes", "uuid": "d662b3a2-3c19-40d7-8198-3542448f38c0", "value": "2030280" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "vhash", "timestamp": "1784339436", "to_ids": true, "type": "vhash", "uuid": "5eea0a30-21ae-4f8e-b235-4c7b9e5ef909", "value": "026066656d1d15645az2c!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T06:53:08+00:00", "last_seen": "2026-04-23T06:53:08+00:00", "object_relation": "filename", "timestamp": "1784339436", "to_ids": true, "type": "filename", "uuid": "5719fa0f-12ec-4b0c-b349-27549b0546c4", "value": "1gr01b2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345888", "uuid": "729be153-77f6-4fec-bb54-ee088c93916a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "md5", "timestamp": "1784345888", "to_ids": true, "type": "md5", "uuid": "1eef76b3-e968-4f06-9b3a-510e4b8c75c0", "value": "72633fc47f89679472f058be0177a494", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "sha1", "timestamp": "1784344407", "to_ids": true, "type": "sha1", "uuid": "0da58625-b62d-4070-8354-b4334cf0ae1f", "value": "31538b5e35ba2ffbe3f67810c773c14c1617ba00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "sha256", "timestamp": "1784344407", "to_ids": true, "type": "sha256", "uuid": "de89d304-3b13-4083-80e8-9d5fa37ca037", "value": "b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "text", "timestamp": "1784339458", "to_ids": false, "type": "text", "uuid": "da750439-92e2-4a60-b338-13f446334768", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-22T18:30:07+00:00\nFirst Submission: 2026-04-22T14:16:54+00:00\nLast Submission: 2026-04-24T13:05:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "ssdeep", "timestamp": "1784339458", "to_ids": true, "type": "ssdeep", "uuid": "8e36e5f2-3dc9-47ea-8e76-e0f77340a633", "value": "49152:FRFf8sQa+bQzpYUHxvhg+2uRDT7qrf/8WCWO3I:FRlxI38HTI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339458", "to_ids": false, "type": "size-in-bytes", "uuid": "85c5ac3d-2b68-410d-8f6a-48c37e55e071", "value": "2371272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "vhash", "timestamp": "1784339458", "to_ids": true, "type": "vhash", "uuid": "66811cca-b6da-432b-a70e-69933249d866", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T14:16:54+00:00", "last_seen": "2026-04-24T13:05:14+00:00", "object_relation": "filename", "timestamp": "1784339458", "to_ids": true, "type": "filename", "uuid": "8383a148-9263-4480-b3ea-5db491124a52", "value": "b5khehoy.hul.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345909", "uuid": "ad3302ed-0774-4769-8504-111a7e3b2828", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "md5", "timestamp": "1784345909", "to_ids": true, "type": "md5", "uuid": "dca260af-64d6-48e2-b595-372119b16976", "value": "03222c6ca2f60f70b95e454141ce8e25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "sha1", "timestamp": "1784344408", "to_ids": true, "type": "sha1", "uuid": "f0da82d5-35f8-45c9-bba8-4c26bad502e3", "value": "58277a661d553f4dcbd8a6dce9f6a29019e3cf4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "sha256", "timestamp": "1784344408", "to_ids": true, "type": "sha256", "uuid": "cee0d55b-44e4-4688-ae53-7449b06f3610", "value": "71c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "text", "timestamp": "1784339479", "to_ids": false, "type": "text", "uuid": "87542bf2-b53e-44e8-a97a-65ca9a4f1f29", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-23T17:24:21+00:00\nFirst Submission: 2026-04-23T16:23:54+00:00\nLast Submission: 2026-04-27T03:35:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "ssdeep", "timestamp": "1784339479", "to_ids": true, "type": "ssdeep", "uuid": "b177ca1a-69dc-4ade-ba6e-7f7715a64ef9", "value": "49152:CvVdfEAlUjqbn4OwlyrT6XVVTPveaFAgyu5Zw:CRgVTH3w" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339479", "to_ids": false, "type": "size-in-bytes", "uuid": "e57fe632-e5f3-4158-b897-227842a057f5", "value": "2624200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "vhash", "timestamp": "1784339479", "to_ids": true, "type": "vhash", "uuid": "c4d9d37f-f501-4679-8022-3de969ee2f43", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T16:23:54+00:00", "last_seen": "2026-04-27T03:35:36+00:00", "object_relation": "filename", "timestamp": "1784339479", "to_ids": true, "type": "filename", "uuid": "a8f4c675-c5d1-40f4-8436-ee2de815a537", "value": "12gvr.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345930", "uuid": "5ac335ee-f717-4134-aecb-c63a6bd1ffb8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "md5", "timestamp": "1784345930", "to_ids": true, "type": "md5", "uuid": "5b4e9d6a-e8f3-4367-90d0-5cab08943018", "value": "056207e13f91698b94ead7c21cc5a1ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "sha1", "timestamp": "1784344410", "to_ids": true, "type": "sha1", "uuid": "5978d2aa-d418-4890-9785-3f133f06aae8", "value": "af143894658b470586693d5a716060e67a3fb06d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "sha256", "timestamp": "1784344410", "to_ids": true, "type": "sha256", "uuid": "1df0ca6f-2274-4216-8e35-d8aacf288060", "value": "2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "text", "timestamp": "1784339500", "to_ids": false, "type": "text", "uuid": "18a37514-8cd8-4850-a08c-c4f8b264676c", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/LummaStealer.GXM!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-04-23T10:52:13+00:00\nLast Submission: 2026-04-23T15:37:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "ssdeep", "timestamp": "1784339500", "to_ids": true, "type": "ssdeep", "uuid": "ccdae6ab-5cad-451d-824e-06d2bd176566", "value": "24576:Rrien/cyew1QvLLejCo6lLkOKGZHpI3Ez1rG/7BzG6ZJXm0acplN5hyzOVkJBVh+:Rj5D+FpT/WJX69T4JV7EfEn7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339500", "to_ids": false, "type": "size-in-bytes", "uuid": "1575a56e-3223-4fff-b379-1c83edb11874", "value": "1949384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "vhash", "timestamp": "1784339500", "to_ids": true, "type": "vhash", "uuid": "9f1b2043-97c0-4a5a-b267-43af9205e314", "value": "016066656d1d15645az2c!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T10:52:13+00:00", "last_seen": "2026-04-23T15:37:15+00:00", "object_relation": "filename", "timestamp": "1784339500", "to_ids": true, "type": "filename", "uuid": "aab52b68-7632-4f02-821e-05b1b9fbead8", "value": "activate.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345952", "uuid": "220087c6-f492-479a-9fc0-c39b64f6c2f0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "md5", "timestamp": "1784345952", "to_ids": true, "type": "md5", "uuid": "6cb61f37-5a78-4889-887a-bd348c4a8ca4", "value": "3c5300ebbc140ec500d5ddc886b95cd5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "sha1", "timestamp": "1784344411", "to_ids": true, "type": "sha1", "uuid": "40b4757b-fa2a-45df-895b-9df8429ab72f", "value": "ab65198ec05f5d3901ab172758770d28f52460c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "sha256", "timestamp": "1784344411", "to_ids": true, "type": "sha256", "uuid": "33e65b37-9aab-4091-9acb-5eadfecc40cd", "value": "98cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b582896", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "text", "timestamp": "1784339522", "to_ids": false, "type": "text", "uuid": "a03f5828-eeec-4d0e-828f-476984c9fa18", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 44/74\nFirst Seen In The Wild: 2026-04-23T09:18:19+00:00\nFirst Submission: 2026-04-23T07:16:59+00:00\nLast Submission: 2026-04-23T07:16:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "ssdeep", "timestamp": "1784339522", "to_ids": true, "type": "ssdeep", "uuid": "e10bfe27-b32e-417c-bc9b-4d1b8963ec67", "value": "49152:1E8NUFbKS1E/Oqdn0bs1dPQTidz0FsJPnF7EyFiAlJsk:1FGimFsHIyFfsk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339522", "to_ids": false, "type": "size-in-bytes", "uuid": "559ddd5c-bab7-4715-82fe-57305984293a", "value": "2791952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "vhash", "timestamp": "1784339522", "to_ids": true, "type": "vhash", "uuid": "75100f1b-caa7-4baa-a2c4-d8fd567ad0d2", "value": "1261376d1575551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T07:16:59+00:00", "last_seen": "2026-04-23T07:16:59+00:00", "object_relation": "filename", "timestamp": "1784339522", "to_ids": true, "type": "filename", "uuid": "fc48d345-94f4-4cfe-8055-b72ba0cc910d", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345973", "uuid": "f4cb83ab-b123-4c94-b737-2500747b717b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "md5", "timestamp": "1784345973", "to_ids": true, "type": "md5", "uuid": "180b9546-e2b7-4136-a81a-a15058fe16cb", "value": "3e177cc39048ad17dce44452666bba0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "sha1", "timestamp": "1784344412", "to_ids": true, "type": "sha1", "uuid": "fdeff06f-ae67-4ac7-8241-f77278af684e", "value": "5f04874433e330d74aa7c7247b543e34ca924f64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "sha256", "timestamp": "1784344412", "to_ids": true, "type": "sha256", "uuid": "7ec7b53d-6b9d-4e35-b44b-7ab648514075", "value": "169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "text", "timestamp": "1784339544", "to_ids": false, "type": "text", "uuid": "9c36ac67-2ce5-42dc-8af2-b7a18980dcca", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Submission: 2026-04-23T11:56:44+00:00\nLast Submission: 2026-04-25T02:34:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "ssdeep", "timestamp": "1784339544", "to_ids": true, "type": "ssdeep", "uuid": "acc6877c-aefd-4303-97fd-9be1d0dbf3a1", "value": "24576:NwP/PjLFDlfcp+SVcg34C3o9fys7wIYLlHeZr8tReRK3ll7dWIlAQY4qG6WcRISf:Nw7LFWp+SKgjGfys0IYLl+qtmUl44O9f" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339544", "to_ids": false, "type": "size-in-bytes", "uuid": "ca5507d2-9390-4e63-bc15-ced1ba4f7918", "value": "1973448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "vhash", "timestamp": "1784339544", "to_ids": true, "type": "vhash", "uuid": "5f43e807-67a9-42d7-b386-96951753aed9", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:56:44+00:00", "last_seen": "2026-04-25T02:34:25+00:00", "object_relation": "filename", "timestamp": "1784339544", "to_ids": true, "type": "filename", "uuid": "e692f94f-104d-43de-9cb7-71efbb7fd90c", "value": "289yxtdo2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345994", "uuid": "cb25eda6-7830-44f3-a163-f866a4322f6e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "md5", "timestamp": "1784345994", "to_ids": true, "type": "md5", "uuid": "f86535f4-570d-4935-b24e-825621c3402d", "value": "5132da5f4c7c4693c7bdfbda5c047300", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "sha1", "timestamp": "1784344413", "to_ids": true, "type": "sha1", "uuid": "05c2a0ff-7c1b-4109-a451-85d5d014f351", "value": "83829a0ed079b4723dcf53183cb53f15bda97ce0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "sha256", "timestamp": "1784344413", "to_ids": true, "type": "sha256", "uuid": "67559b27-d4c7-48b0-bb47-a39fbbf555c4", "value": "c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "text", "timestamp": "1784339567", "to_ids": false, "type": "text", "uuid": "3a61c6de-f82b-4e41-ae5f-771ecf910570", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-17T04:44:15+00:00\nFirst Submission: 2026-04-17T03:44:04+00:00\nLast Submission: 2026-04-17T13:23:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "ssdeep", "timestamp": "1784339567", "to_ids": true, "type": "ssdeep", "uuid": "9b53a002-3ea0-42c3-a376-f5a6a27e8393", "value": "24576:6AUfCjbR7QyXHFf2LSQIjbIkVg9YxkqQk5w9oGWSCvYwNTBele5y92XUsKmD:6NfS177HF+2X/Ieg9fgcRWSnyFF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339567", "to_ids": false, "type": "size-in-bytes", "uuid": "3d0c5e5f-13a2-4fad-9ad1-f8391c627307", "value": "2441856" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "vhash", "timestamp": "1784339567", "to_ids": true, "type": "vhash", "uuid": "0fc27136-b1bd-4c70-9de0-390102396af3", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T03:44:04+00:00", "last_seen": "2026-04-17T13:23:21+00:00", "object_relation": "filename", "timestamp": "1784339567", "to_ids": true, "type": "filename", "uuid": "64ae1501-4d99-43e6-a3c4-d147f77fbb0e", "value": "58tib2k.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346015", "uuid": "1fd2b101-5a49-4f08-a450-310bae1125f9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "md5", "timestamp": "1784346015", "to_ids": true, "type": "md5", "uuid": "1a474412-ef38-47a9-8aa8-d13a2eadc7d4", "value": "55e7443b66c9c626abe71551233e0a30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "sha1", "timestamp": "1784344414", "to_ids": true, "type": "sha1", "uuid": "69370c79-91e9-4806-a2f6-a7873f8b76be", "value": "f918003e61dedc1915433352ffd38c4cb8e4fcd3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "sha256", "timestamp": "1784344414", "to_ids": true, "type": "sha256", "uuid": "23b0581d-ca52-4afe-a848-e0ea6c3591e9", "value": "f760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "text", "timestamp": "1784339588", "to_ids": false, "type": "text", "uuid": "1a1b6d92-803b-49f2-86dc-156913bb1ffe", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 50/74\nFirst Submission: 2026-04-23T19:06:48+00:00\nLast Submission: 2026-04-23T19:13:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "ssdeep", "timestamp": "1784339588", "to_ids": true, "type": "ssdeep", "uuid": "7f7e9454-d041-4cbf-b9de-ae5e0171c27d", "value": "24576:DUoP5Lv52bThYB6uo0nFedNe0RCjdne54nT3MmcA6kdFPBGqG6WcRg7NX3:DUYJv8hYBrn6e0RCJ8CT3MTAPd/GOCJ3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339588", "to_ids": false, "type": "size-in-bytes", "uuid": "e98cc5cf-da30-40d0-89c8-437d933072a0", "value": "1965768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "vhash", "timestamp": "1784339588", "to_ids": true, "type": "vhash", "uuid": "38c2b31c-ba7f-481c-8d33-9423785c2232", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T19:06:48+00:00", "last_seen": "2026-04-23T19:13:54+00:00", "object_relation": "filename", "timestamp": "1784339588", "to_ids": true, "type": "filename", "uuid": "83403d0f-b661-4bd8-b2e0-9e871c605158", "value": "Bootstrapper.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346036", "uuid": "069bf253-92fb-4995-a48e-adffca6b37f6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "md5", "timestamp": "1784346036", "to_ids": true, "type": "md5", "uuid": "258ef15a-4d29-45c5-b432-dc01c218eff7", "value": "655393e472be5409bc0ff521aa1662de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "sha1", "timestamp": "1784344415", "to_ids": true, "type": "sha1", "uuid": "55f65796-f538-45ff-95b7-f0f6ac65cf6e", "value": "88007dfcf4adb5f8841a663bd028b1420d0ca574", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "sha256", "timestamp": "1784344415", "to_ids": true, "type": "sha256", "uuid": "46e93efa-cce4-4df9-a709-efe501a0df4c", "value": "2c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "text", "timestamp": "1784339610", "to_ids": false, "type": "text", "uuid": "698b9fae-1ff1-4a1d-930b-611d7a00baf6", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-23T14:54:02+00:00\nFirst Submission: 2026-04-23T13:53:41+00:00\nLast Submission: 2026-04-24T03:50:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "ssdeep", "timestamp": "1784339610", "to_ids": true, "type": "ssdeep", "uuid": "9222aac6-e580-44ee-933b-7ea7afd879d9", "value": "49152:XN+etlNG4kBh7YcTl3dV8f9sx5AxHvuvZevqSShJqulFosv:XQ6GiVvGOqesv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339610", "to_ids": false, "type": "size-in-bytes", "uuid": "405a4d6a-3121-44bb-991c-6f154d92d08d", "value": "2799128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "vhash", "timestamp": "1784339610", "to_ids": true, "type": "vhash", "uuid": "f4af97fe-265c-4a66-a525-64eaea30e394", "value": "1261376d1575551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:53:41+00:00", "last_seen": "2026-04-24T03:50:20+00:00", "object_relation": "filename", "timestamp": "1784339610", "to_ids": true, "type": "filename", "uuid": "928cc97a-1ce6-4fcb-8e11-873310c1457e", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346057", "uuid": "1fdb5a44-55f9-4ca9-b64e-d90a39c3e114", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "md5", "timestamp": "1784346057", "to_ids": true, "type": "md5", "uuid": "646fde3e-4c9a-4695-ae69-99c8c98f6eb2", "value": "684c8447df60b13bc258a33ed636ce93", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "sha1", "timestamp": "1784344416", "to_ids": true, "type": "sha1", "uuid": "d45b2943-4f7a-40a3-bfb2-2d2f42222a73", "value": "489e62c252832cdb5cacf35bd6b193aeecc816c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "sha256", "timestamp": "1784344416", "to_ids": true, "type": "sha256", "uuid": "2ddbcab2-d090-4138-a4c0-a193eaeedcb8", "value": "a1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "text", "timestamp": "1784339631", "to_ids": false, "type": "text", "uuid": "90693253-e386-4fe3-bede-4913a4bc6619", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-22T22:43:34+00:00\nFirst Submission: 2026-04-22T21:43:23+00:00\nLast Submission: 2026-04-23T08:30:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "ssdeep", "timestamp": "1784339631", "to_ids": true, "type": "ssdeep", "uuid": "d28667d0-3292-453d-b033-99df461c039f", "value": "49152:mMvCr808QxWuEQUo/BCN0uErNVfE89ZSRmmjFixdefnPjOSB:mMw3GRxgxenP3B" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339631", "to_ids": false, "type": "size-in-bytes", "uuid": "28432567-c316-4b9d-9c30-6a4a5d22a262", "value": "2371272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "vhash", "timestamp": "1784339631", "to_ids": true, "type": "vhash", "uuid": "62be40ca-c36a-4ee7-984d-0f0fc9d40eee", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T21:43:23+00:00", "last_seen": "2026-04-23T08:30:23+00:00", "object_relation": "filename", "timestamp": "1784339631", "to_ids": true, "type": "filename", "uuid": "416828e4-b31b-4606-8793-50152186e770", "value": "V\u0435r\u043et\u0430\u0440\u0440\u0435r64.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346078", "uuid": "deea8fa9-3144-495b-bbf7-7966780786ce", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "md5", "timestamp": "1784346078", "to_ids": true, "type": "md5", "uuid": "6d1f9ab7-aa43-4d48-be13-742d5b023216", "value": "70f7dc41628613af7bb16490ca6c8510", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "sha1", "timestamp": "1784344418", "to_ids": true, "type": "sha1", "uuid": "b1268df4-b450-4907-88e5-eb61ea5eee36", "value": "d03fb33f17fbfd59605f11999503eb8fb91858bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "sha256", "timestamp": "1784344418", "to_ids": true, "type": "sha256", "uuid": "6763b6d9-7549-4b1f-a3df-69c25e0521db", "value": "67569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "text", "timestamp": "1784339653", "to_ids": false, "type": "text", "uuid": "c96d6566-2e6a-4f8d-935b-e816eb9568e6", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:02 AM 07/15/2026\nMicrosoft: Trojan:Win64/Tedy!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-24T02:55:24+00:00\nFirst Submission: 2026-04-24T01:55:10+00:00\nLast Submission: 2026-04-24T20:25:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "ssdeep", "timestamp": "1784339653", "to_ids": true, "type": "ssdeep", "uuid": "b3a4bad7-cb80-48a6-8f49-aec905f2e9e4", "value": "24576:iANTe1RTJ1Sst41COAVcLDkI6ZAAe0dNSjjhvF7Y9eDuIjntIMA8lqG6WcRctl7Q:iA5e1tSsekIYAKdNIjhdzDuytVpOAK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339653", "to_ids": false, "type": "size-in-bytes", "uuid": "d9fe7b71-d556-4905-8f9d-cd774e25ebd0", "value": "14949584" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "vhash", "timestamp": "1784339653", "to_ids": true, "type": "vhash", "uuid": "fd07b2d9-a111-4014-84c7-d00c04794765", "value": "017086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T01:55:10+00:00", "last_seen": "2026-04-24T20:25:48+00:00", "object_relation": "filename", "timestamp": "1784339653", "to_ids": true, "type": "filename", "uuid": "fc58ca91-574a-4032-aebf-b8de43ed0fff", "value": "RivalMods.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346099", "uuid": "d07878c7-08e1-4b21-b96f-7e7a96d26eee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "md5", "timestamp": "1784346099", "to_ids": true, "type": "md5", "uuid": "7daa5130-7032-4330-96c5-7356b6b1d9a9", "value": "874df2d775a5eb406bc9d2c8811ce8c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "sha1", "timestamp": "1784344419", "to_ids": true, "type": "sha1", "uuid": "2469a218-55d5-458e-b492-1724cd748729", "value": "f61f7914bc915133422265d1a740300b73275658", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "sha256", "timestamp": "1784344419", "to_ids": true, "type": "sha256", "uuid": "f5e1e14d-cdad-4513-a363-e6a90156b669", "value": "d7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "text", "timestamp": "1784339674", "to_ids": false, "type": "text", "uuid": "d07e9c10-8f92-4b0a-84ae-4cb1416d89e8", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-23T14:10:15+00:00\nFirst Submission: 2026-04-23T13:10:03+00:00\nLast Submission: 2026-04-26T00:19:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "ssdeep", "timestamp": "1784339674", "to_ids": true, "type": "ssdeep", "uuid": "c795bb3d-4792-4a7a-8101-77895ad5bbda", "value": "49152:7/HE4g12RYooQhIIZKaJHyALxBy0arryFf0yoOK0:7GPXS1ar00yM0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339674", "to_ids": false, "type": "size-in-bytes", "uuid": "89be48a5-7d41-4738-9eda-175fbaf7d69d", "value": "2372808" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "vhash", "timestamp": "1784339674", "to_ids": true, "type": "vhash", "uuid": "7f25db0d-e5e0-41d7-b885-584486383276", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:10:03+00:00", "last_seen": "2026-04-26T00:19:52+00:00", "object_relation": "filename", "timestamp": "1784339674", "to_ids": true, "type": "filename", "uuid": "2072cc1d-d1c5-428e-98e9-2766f70c748e", "value": "cumqukb6e.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346121", "uuid": "3e4e1b3b-897d-46c5-967c-14bcc15c41e2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "md5", "timestamp": "1784346121", "to_ids": true, "type": "md5", "uuid": "22419b0f-32b4-4b04-b913-3842426fd204", "value": "8c2b728e57531e24813e628cfba3f1c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "sha1", "timestamp": "1784344420", "to_ids": true, "type": "sha1", "uuid": "722a7f45-648d-4990-bdaf-0454c017c31a", "value": "816a01fd37bb02ed9d8276b21e4b48f9bd9ea6de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "sha256", "timestamp": "1784344420", "to_ids": true, "type": "sha256", "uuid": "dd37730d-8a0e-4498-b827-10f9a90d2f7f", "value": "20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a2275", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "text", "timestamp": "1784339696", "to_ids": false, "type": "text", "uuid": "5b597c4f-f01c-4a86-a945-1157895bfc9a", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2026-04-16T07:13:09+00:00\nLast Submission: 2026-04-16T07:13:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "ssdeep", "timestamp": "1784339696", "to_ids": true, "type": "ssdeep", "uuid": "1a15c5fc-988c-4dd7-b0b0-e3a82efc6488", "value": "24576:O1OTt7a7TWUgfArmxJYI+u50WftvU3F40eyPXBTBele5y92XUaelQt:O1OTJGTwAr8JY+EmNyPSyX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339696", "to_ids": false, "type": "size-in-bytes", "uuid": "2b56b19e-056a-49cb-b168-9c3e81c9deb6", "value": "19251328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "vhash", "timestamp": "1784339696", "to_ids": true, "type": "vhash", "uuid": "3a666cbd-5ac6-48d8-8f47-2514186939e0", "value": "017086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T07:13:09+00:00", "last_seen": "2026-04-16T07:13:09+00:00", "object_relation": "filename", "timestamp": "1784339696", "to_ids": true, "type": "filename", "uuid": "96987355-cb68-4928-ab72-405193c3d237", "value": "FL_Studio_Activator.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346142", "uuid": "7004d9f0-081a-4718-8b10-0f51449b25af", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "md5", "timestamp": "1784346142", "to_ids": true, "type": "md5", "uuid": "fe451df2-0a6a-4838-bfa8-d4166147e64a", "value": "8ff9f6c05dfde0ee639c36cb53cb29a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "sha1", "timestamp": "1784344421", "to_ids": true, "type": "sha1", "uuid": "1ab1ec43-44a9-4e81-8d2c-bba7de16db4f", "value": "b990a6434f98354026cec72f3fb7389172e80da2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "sha256", "timestamp": "1784344422", "to_ids": true, "type": "sha256", "uuid": "c554fb78-5235-47be-9d14-1ec4f11bc1dc", "value": "7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "text", "timestamp": "1784339717", "to_ids": false, "type": "text", "uuid": "eefe6f9f-b8fe-4737-a891-c09c8225d464", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-15T19:25:30+00:00\nFirst Submission: 2026-04-15T15:51:45+00:00\nLast Submission: 2026-04-15T18:17:21+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "creation-time", "timestamp": "1784339717", "to_ids": false, "type": "datetime", "uuid": "e6bc419f-ca88-4b20-b6de-2240aaf456f1", "value": "2024-07-09T06:31:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "ssdeep", "timestamp": "1784339717", "to_ids": true, "type": "ssdeep", "uuid": "9b492005-8d2f-43fc-bb9c-b69cbb1565cc", "value": "98304:JT409snK6xMCF+92tYHYMLFw6jglb4Zt4B1InT6UASC7aVicm9BcQBK5QfpU/KKF:JUfF+9fYQFmjAOUA25mAFCUCKC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339717", "to_ids": false, "type": "size-in-bytes", "uuid": "af1ced21-9e68-4a36-8d8d-cd0ea85be28b", "value": "9604608" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "vhash", "timestamp": "1784339717", "to_ids": true, "type": "vhash", "uuid": "46ad282b-c6aa-4583-b14f-3d605abf5764", "value": "0960b76d1555655c0d5d1058z5845fz33z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:51:45+00:00", "last_seen": "2026-04-15T18:17:21+00:00", "object_relation": "filename", "timestamp": "1784339717", "to_ids": true, "type": "filename", "uuid": "9cee8dfb-3aaa-43d8-95b7-3c536619b37d", "value": "f39en.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346163", "uuid": "a0299f8a-8f79-4199-920b-cd0a43b840cf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "md5", "timestamp": "1784346163", "to_ids": true, "type": "md5", "uuid": "4f65a563-689f-47ca-a11f-bc2ee186c70a", "value": "96bc7cf49632b140a196c50a8f0e43cc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "sha1", "timestamp": "1784344423", "to_ids": true, "type": "sha1", "uuid": "d45ed3f6-26c5-4349-9cc3-3e0a41a05837", "value": "854573698765139e2f48dd38f2d77f1db472d1b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "sha256", "timestamp": "1784344423", "to_ids": true, "type": "sha256", "uuid": "8a51e51b-b87b-4730-8d6c-d9098eecbf0f", "value": "2b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c15397", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "text", "timestamp": "1784339738", "to_ids": false, "type": "text", "uuid": "60f8bdea-e916-4430-8b82-5079c4453584", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 50/74\nFirst Seen In The Wild: 2026-04-23T15:44:23+00:00\nFirst Submission: 2026-04-23T14:44:21+00:00\nLast Submission: 2026-04-23T14:44:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "ssdeep", "timestamp": "1784339738", "to_ids": true, "type": "ssdeep", "uuid": "e029c517-0be8-43e5-b182-a083afb58d21", "value": "49152:C2CYBBF6yGXdShXBQxjGSIJnIV2+vsAiBKpBKOJj:CAmqJIScjj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339738", "to_ids": false, "type": "size-in-bytes", "uuid": "55b3c7ff-a0a5-491f-8c93-72aa12aeb71f", "value": "2364616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "vhash", "timestamp": "1784339738", "to_ids": true, "type": "vhash", "uuid": "c3415df7-5e19-4b36-8aa3-85b0b889c113", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:44:21+00:00", "last_seen": "2026-04-23T14:44:21+00:00", "object_relation": "filename", "timestamp": "1784339739", "to_ids": true, "type": "filename", "uuid": "332d3eb7-bde7-458d-bec3-737e38cfc493", "value": "yiez8my.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346184", "uuid": "325a29d0-ad1c-4d47-b6c3-598cb23d1317", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "md5", "timestamp": "1784346184", "to_ids": true, "type": "md5", "uuid": "26593e93-c863-46c2-8e79-cddef58aa4be", "value": "a4d12dfb189162105608636e63e5b2c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "sha1", "timestamp": "1784344424", "to_ids": true, "type": "sha1", "uuid": "67e4a936-ba43-4f68-81f2-801379d70b05", "value": "7633532821c8a10f1c789071cada50023bb40ca3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "sha256", "timestamp": "1784344424", "to_ids": true, "type": "sha256", "uuid": "aad514ed-163d-48fd-a371-0bf318b144c6", "value": "96bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a03", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "text", "timestamp": "1784339760", "to_ids": false, "type": "text", "uuid": "71dd73b6-9907-47ac-8d87-9709012425a3", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:03 AM 07/15/2026\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-23T14:26:31+00:00\nFirst Submission: 2026-04-23T13:26:14+00:00\nLast Submission: 2026-04-23T13:26:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "ssdeep", "timestamp": "1784339760", "to_ids": true, "type": "ssdeep", "uuid": "d9de318c-99da-47ea-800c-2586948fc348", "value": "49152:rcmDOjM7nq4IdZ18YodSR/GbxpnoJZKDP8Ok5xx1/KjTSs+dwR7h43MLT0dOMn:rrUb5ln1v33MLT0fn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339760", "to_ids": false, "type": "size-in-bytes", "uuid": "21f24878-2652-4445-81f4-1fca9653b837", "value": "2373832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "vhash", "timestamp": "1784339760", "to_ids": true, "type": "vhash", "uuid": "7e771f2d-0e54-495a-9429-55d169d7c4cc", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:26:14+00:00", "last_seen": "2026-04-23T13:26:14+00:00", "object_relation": "filename", "timestamp": "1784339760", "to_ids": true, "type": "filename", "uuid": "97003f56-595c-4197-af5a-0405f10008a1", "value": "9nz5pa5nr.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346205", "uuid": "580d0cbc-866b-4af1-b7ae-764e895c644f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "md5", "timestamp": "1784346205", "to_ids": true, "type": "md5", "uuid": "97324d91-2772-4b44-a75f-a04b80a33bd6", "value": "c7abe29809cd243a2dfe4d8f1c004228", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "sha1", "timestamp": "1784344425", "to_ids": true, "type": "sha1", "uuid": "81078925-3653-46cf-b0ab-36ee9a3f2311", "value": "e53db7080cc07da148c633c65d59c75548f00a84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "sha256", "timestamp": "1784344425", "to_ids": true, "type": "sha256", "uuid": "ae36a027-14fe-4d38-bb4a-a4663dafd426", "value": "53d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "text", "timestamp": "1784339804", "to_ids": false, "type": "text", "uuid": "f421c6d1-46fd-487a-b6cf-39dc6cc2f076", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:02 AM 07/15/2026\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2026-04-21T15:55:00+00:00\nLast Submission: 2026-04-26T08:37:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "ssdeep", "timestamp": "1784339804", "to_ids": true, "type": "ssdeep", "uuid": "c8676021-cf90-416c-98c4-d844a680766a", "value": "24576:LHLo5GmAY3mNewsdDAmgjbrVC5GRsc7d+6NAyaI6E/6jfOYGZlbljeyvp:LnNLs1qiyl6E/6jfubljeop" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339804", "to_ids": false, "type": "size-in-bytes", "uuid": "36f9ae79-140e-4517-b741-0c05d6b694a9", "value": "1706184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "vhash", "timestamp": "1784339804", "to_ids": true, "type": "vhash", "uuid": "540baa2f-f047-4bf6-a21c-39316033f94b", "value": "016066656d5d15645az2d!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T15:55:00+00:00", "last_seen": "2026-04-26T08:37:49+00:00", "object_relation": "filename", "timestamp": "1784339804", "to_ids": true, "type": "filename", "uuid": "85443a0b-23f1-4057-ab72-25bad7b5edbc", "value": "d83gk.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346226", "uuid": "b52f09f1-c8cb-4b4f-bedc-9db8cc327c1f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "md5", "timestamp": "1784346226", "to_ids": true, "type": "md5", "uuid": "33dc38da-d927-4793-a9ae-5dbb2478124c", "value": "ce0f23981ef41b8be349b32e7bfb70ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "sha1", "timestamp": "1784344426", "to_ids": true, "type": "sha1", "uuid": "b2e7e066-9b2c-4eba-8cfe-c9405eec7e99", "value": "4bd372ca29c2efa50740c9e38c72768e4521b8de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "sha256", "timestamp": "1784344426", "to_ids": true, "type": "sha256", "uuid": "5a69b59e-0b4d-48b4-b9d3-1ea8eac04828", "value": "5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "text", "timestamp": "1784339826", "to_ids": false, "type": "text", "uuid": "3cde717a-fde0-4604-88ba-0bd8ffaf8d65", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Lazy!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-23T15:30:11+00:00\nFirst Submission: 2026-04-23T11:09:47+00:00\nLast Submission: 2026-04-23T20:53:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "ssdeep", "timestamp": "1784339826", "to_ids": true, "type": "ssdeep", "uuid": "2d171bbf-a3fd-4ab5-b68a-cae446c62399", "value": "49152:pIXqEXcMQiN7ld0+Ft+Mf4NOAadpkLjgn0dORE:p2hQOZE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339826", "to_ids": false, "type": "size-in-bytes", "uuid": "de39bf03-c0cd-4784-8959-8b86f4febf8b", "value": "26489552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "vhash", "timestamp": "1784339826", "to_ids": true, "type": "vhash", "uuid": "e739c810-a36b-4e50-9fee-99db9b0d94fc", "value": "027086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:09:47+00:00", "last_seen": "2026-04-23T20:53:50+00:00", "object_relation": "filename", "timestamp": "1784339826", "to_ids": true, "type": "filename", "uuid": "0b92434c-9e8f-444e-87c2-d1c355cb8065", "value": "Setup64x.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346247", "uuid": "8910f0d9-3b2c-4ae2-9869-753747624c99", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "md5", "timestamp": "1784346247", "to_ids": true, "type": "md5", "uuid": "22c1ea76-cab0-4c8f-a5e4-bd1472deabd0", "value": "f38a0009fac3944821ff2a2f021ab413", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "sha1", "timestamp": "1784344427", "to_ids": true, "type": "sha1", "uuid": "1fe497e3-0a78-40bb-a103-f4c49b264f3d", "value": "b8c97c5e65548506c06d924a0726aeeb73478399", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "sha256", "timestamp": "1784344427", "to_ids": true, "type": "sha256", "uuid": "24581369-5ff1-4fd2-8019-488ff2af78b1", "value": "a785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "text", "timestamp": "1784339847", "to_ids": false, "type": "text", "uuid": "5ff39e96-2afd-4bf6-bfe6-e2cfaf75d4d0", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-23T01:03:19+00:00\nFirst Submission: 2026-04-23T00:03:08+00:00\nLast Submission: 2026-04-23T20:34:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "ssdeep", "timestamp": "1784339847", "to_ids": true, "type": "ssdeep", "uuid": "770046b9-abf3-4fe4-a23a-9211f1d13cc0", "value": "49152:dh3pkh1+ulLqvjEp5ZflbQywviVlvkM6A/NBOcU:d8tB6ENfU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339847", "to_ids": false, "type": "size-in-bytes", "uuid": "e700244d-2a0d-4095-b47a-25bbc37921df", "value": "12854480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "vhash", "timestamp": "1784339847", "to_ids": true, "type": "vhash", "uuid": "9d2c312e-c866-4f91-a866-1efbb2ba2823", "value": "017086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T00:03:08+00:00", "last_seen": "2026-04-23T20:34:13+00:00", "object_relation": "filename", "timestamp": "1784339847", "to_ids": true, "type": "filename", "uuid": "0f0fe20b-4d65-4eff-a21c-8039f2cc1565", "value": "Setup.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346268", "uuid": "5cf1f876-842a-4b70-aec4-ce228143de79", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "md5", "timestamp": "1784346268", "to_ids": true, "type": "md5", "uuid": "45184698-c87b-48ce-8475-5bca2e44cdf0", "value": "835b573fda89f81bae171d07c907868a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "sha1", "timestamp": "1784344429", "to_ids": true, "type": "sha1", "uuid": "b3fcedab-2f53-4b36-aada-f9a1507af7c6", "value": "871b656c2c2823863243334c13a8a0621d7a8de7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "sha256", "timestamp": "1784344429", "to_ids": true, "type": "sha256", "uuid": "3a114841-9061-428e-9d3f-a4a54269d141", "value": "097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "text", "timestamp": "1784339890", "to_ids": false, "type": "text", "uuid": "24479bce-1dac-4480-8df4-5b93bfe3129d", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2026-04-15T12:35:35+00:00\nLast Submission: 2026-04-15T12:35:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "ssdeep", "timestamp": "1784339890", "to_ids": true, "type": "ssdeep", "uuid": "2224b70a-4bd9-4ef8-b7ae-ecb8aa073a6f", "value": "24576:ob6X8bkzzN29qy4yGbgCoL021MNM8cbussyfUUq+7cYkXBWdbNTBele5y92CUbuI:ob6XA4zNy4fbloIoMe8ciMF7cYRda17I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339890", "to_ids": false, "type": "size-in-bytes", "uuid": "e0412f98-da70-4715-80e6-45de17f261ab", "value": "515185280" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "vhash", "timestamp": "1784339890", "to_ids": true, "type": "vhash", "uuid": "3e716f3d-d443-4576-9afe-d544c101ed84", "value": "058086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T12:35:35+00:00", "last_seen": "2026-04-15T12:35:35+00:00", "object_relation": "filename", "timestamp": "1784339890", "to_ids": true, "type": "filename", "uuid": "d94c48e5-8a13-420f-873d-c4edf2802c4d", "value": "CapCut_Desktop[Pro].exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346289", "uuid": "cc0361ba-76af-4f19-b751-d204b58c8ea4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "md5", "timestamp": "1784346289", "to_ids": true, "type": "md5", "uuid": "1e8ff926-4ced-4d2f-aafa-794366c4d8e1", "value": "1dca3026799611054005394ffc281287", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "sha1", "timestamp": "1784344429", "to_ids": true, "type": "sha1", "uuid": "4df3ece8-5e22-4238-adaf-b97e8047287f", "value": "0b444a54dc942c3cac9f6add3e0da544b4ad8353", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "sha256", "timestamp": "1784344429", "to_ids": true, "type": "sha256", "uuid": "99b50871-82ee-456b-b9e1-9b32ee4d6c1c", "value": "0a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "text", "timestamp": "1784339912", "to_ids": false, "type": "text", "uuid": "d7c14563-d3b5-449c-910d-f297f0206e2f", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-16T11:54:40+00:00\nFirst Submission: 2026-04-16T10:54:19+00:00\nLast Submission: 2026-05-29T20:45:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "ssdeep", "timestamp": "1784339912", "to_ids": true, "type": "ssdeep", "uuid": "f54d9154-e2ab-4a65-9e6a-065af043cba5", "value": "49152:SvnGfCyzCfvtwQ94/5xrDXlEdAZQnSysA:SOWqQ9c5xrDXlEWFysA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339912", "to_ids": false, "type": "size-in-bytes", "uuid": "a85a6ecd-3866-4e54-ab59-54229f8d7e93", "value": "2589696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "vhash", "timestamp": "1784339912", "to_ids": true, "type": "vhash", "uuid": "13ec6f2e-72c4-4641-bded-525c144133c9", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:54:19+00:00", "last_seen": "2026-05-29T20:45:22+00:00", "object_relation": "filename", "timestamp": "1784339912", "to_ids": true, "type": "filename", "uuid": "984f68fe-15b2-4598-bccd-1db94dddd137", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346310", "uuid": "16a34b49-abc6-4a08-89e2-86f56459f633", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "md5", "timestamp": "1784346310", "to_ids": true, "type": "md5", "uuid": "ee781584-9bbb-43e9-82bd-8cc0b1d183c5", "value": "036e8971a75c5930a47c78e53075286e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "sha1", "timestamp": "1784344431", "to_ids": true, "type": "sha1", "uuid": "fd3c2dc3-f676-4d2d-a716-d90fbb98418e", "value": "42962ccdd11a63524f346e10b8ba9037a0176460", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "sha256", "timestamp": "1784344431", "to_ids": true, "type": "sha256", "uuid": "c04e2b9f-9558-449c-9fa7-9d4f4fbd82ee", "value": "15489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "text", "timestamp": "1784339933", "to_ids": false, "type": "text", "uuid": "df97d3e1-dd7b-4f0e-8583-be8edff1e5ea", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-24T02:45:45+00:00\nFirst Submission: 2026-04-24T01:45:31+00:00\nLast Submission: 2026-04-24T17:07:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "ssdeep", "timestamp": "1784339933", "to_ids": true, "type": "ssdeep", "uuid": "87f826d3-b0d9-439e-a159-e6231eca9672", "value": "49152:V4PnEK/DpPxshj78XMeD7P1/utUflPGOxod:VgzFOd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339933", "to_ids": false, "type": "size-in-bytes", "uuid": "3693ce7b-2f41-46ff-a78a-82d4ec7d4c22", "value": "26488528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "vhash", "timestamp": "1784339933", "to_ids": true, "type": "vhash", "uuid": "305802a9-6ddf-4dd0-b2ff-62db98f9a2b8", "value": "027086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T01:45:31+00:00", "last_seen": "2026-04-24T17:07:06+00:00", "object_relation": "filename", "timestamp": "1784339933", "to_ids": true, "type": "filename", "uuid": "232fc4b0-ae3c-4370-9e21-959f08b0e44f", "value": "Setup64X.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346331", "uuid": "556344ea-7862-4fb3-88fd-7305f6a7b9e4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "md5", "timestamp": "1784346331", "to_ids": true, "type": "md5", "uuid": "b07ec0d6-3bbf-4efe-9908-ac26da3637ce", "value": "3d9b62b6e416c8dcc6f14d56555736a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "sha1", "timestamp": "1784344432", "to_ids": true, "type": "sha1", "uuid": "97c2dafb-62b9-45f5-8453-7a4e0e6cadcc", "value": "c20f940db6fc55d662cf9ac8f65e1c28f73403f6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "sha256", "timestamp": "1784344432", "to_ids": true, "type": "sha256", "uuid": "78d3e8f5-41d9-4838-8088-09c93365c078", "value": "201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "text", "timestamp": "1784339955", "to_ids": false, "type": "text", "uuid": "1d8f287b-4a82-4951-a637-76bdfeaff218", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 50/74\nFirst Submission: 2026-04-16T18:20:52+00:00\nLast Submission: 2026-04-19T05:13:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "ssdeep", "timestamp": "1784339955", "to_ids": true, "type": "ssdeep", "uuid": "40854e57-638c-4090-a4cc-c59c988394bc", "value": "24576:GSmqik5NIYfgY5Yl66zBbG6aCK0EKFhele5n92ycl74+o:GSuuNINY5Y8QBtaCdrC49" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339955", "to_ids": false, "type": "size-in-bytes", "uuid": "47bcf741-1712-46db-8ef0-df1faec5c4c2", "value": "1814656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "vhash", "timestamp": "1784339955", "to_ids": true, "type": "vhash", "uuid": "db155c95-8adb-4e1e-b268-1ff7492919d9", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:20:52+00:00", "last_seen": "2026-04-19T05:13:20+00:00", "object_relation": "filename", "timestamp": "1784339955", "to_ids": true, "type": "filename", "uuid": "3b21a3c0-1a3e-4b70-8f2c-36898414d36b", "value": "NS_GameHub.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346352", "uuid": "6c0d3f2f-16f0-4602-89fb-aec59e503e0d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "md5", "timestamp": "1784346352", "to_ids": true, "type": "md5", "uuid": "62c1716e-4613-40a2-872b-ac529610eff7", "value": "469ef0887d7d775cac38c36fcdebf3c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "sha1", "timestamp": "1784344433", "to_ids": true, "type": "sha1", "uuid": "8b76e98e-8d93-4f65-954e-604d7703892b", "value": "9aaff3a886af35887d585b655a287e819d8fd3be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "sha256", "timestamp": "1784344433", "to_ids": true, "type": "sha256", "uuid": "b36206be-b03c-4248-bda8-73e28535a02a", "value": "2a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab498", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "text", "timestamp": "1784339977", "to_ids": false, "type": "text", "uuid": "a439acc0-3a16-4fd4-bcb5-f5e4674a396b", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 50/74\nFirst Seen In The Wild: 2026-04-23T02:41:49+00:00\nFirst Submission: 2026-04-23T01:41:19+00:00\nLast Submission: 2026-04-26T00:29:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "ssdeep", "timestamp": "1784339977", "to_ids": true, "type": "ssdeep", "uuid": "3dce6e86-9161-4440-b5c6-a23b894d22f5", "value": "49152:x2CYBB9K0f4j4fcLwbtCRJeaz4z5DNmO7H:xlfJeaEHHH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339977", "to_ids": false, "type": "size-in-bytes", "uuid": "a848d7da-ee28-4a4e-b5d8-f0c02f67316b", "value": "2367176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "vhash", "timestamp": "1784339977", "to_ids": true, "type": "vhash", "uuid": "2823e66f-f7b4-47e7-923d-e59d340b8d98", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T01:41:19+00:00", "last_seen": "2026-04-26T00:29:06+00:00", "object_relation": "filename", "timestamp": "1784339977", "to_ids": true, "type": "filename", "uuid": "68d3292b-2eb8-4f07-998a-c422ee7e6b27", "value": "Setup.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346373", "uuid": "0fe16320-0a3b-4832-87f5-08e54ae61ea2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "md5", "timestamp": "1784346373", "to_ids": true, "type": "md5", "uuid": "be994905-033d-4284-ac89-3752604fbf12", "value": "bc7f535229792b86fd4f0cb2b28d5e6f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "sha1", "timestamp": "1784344435", "to_ids": true, "type": "sha1", "uuid": "7b143257-5bd3-45ee-9d9a-21bda52bbe10", "value": "936cacabf3038bf2d49d09f23acfda5adf9e2fac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "sha256", "timestamp": "1784344435", "to_ids": true, "type": "sha256", "uuid": "3df33b67-f55a-48b6-af8e-6ced7c14d7bd", "value": "2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "text", "timestamp": "1784339998", "to_ids": false, "type": "text", "uuid": "bee3a2a5-cd30-4507-b455-9c318e996a0c", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Seen In The Wild: 2026-04-24T05:49:34+00:00\nFirst Submission: 2026-04-24T04:49:09+00:00\nLast Submission: 2026-04-25T12:14:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "ssdeep", "timestamp": "1784339998", "to_ids": true, "type": "ssdeep", "uuid": "632570e9-1e38-42b9-a91f-3a2de77536a1", "value": "49152:hrRTuPbi+JyjkiGXpjnhw4Pex1KJ+8MbOoOxWI:hEjhwbx1bI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784339998", "to_ids": false, "type": "size-in-bytes", "uuid": "9a528879-dd4d-4ebc-8470-79c29d6aff7a", "value": "7615696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "vhash", "timestamp": "1784339998", "to_ids": true, "type": "vhash", "uuid": "bd1364a4-139a-4955-9aad-8d52143b9628", "value": "076086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:49:09+00:00", "last_seen": "2026-04-25T12:14:33+00:00", "object_relation": "filename", "timestamp": "1784339998", "to_ids": true, "type": "filename", "uuid": "e13bdb2b-ac87-4c33-99f3-5b03513fab1b", "value": "SoftWare.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346395", "uuid": "60475c8e-15e4-4c4e-83e5-9f8ea53ae011", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "md5", "timestamp": "1784346395", "to_ids": true, "type": "md5", "uuid": "1e25a9d7-0320-4fd0-be93-ab24d93ae462", "value": "38cb08e3894a9d30230ba0888fc6f156", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "sha1", "timestamp": "1784344436", "to_ids": true, "type": "sha1", "uuid": "cb456453-dee1-47ea-9ea8-77164075c163", "value": "7abfa56db0409c5b28f362e987b1942d9bf92f45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "sha256", "timestamp": "1784344436", "to_ids": true, "type": "sha256", "uuid": "0e47cff1-5ea8-4cd0-85fb-819660836812", "value": "2f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "text", "timestamp": "1784340020", "to_ids": false, "type": "text", "uuid": "95cab477-43d4-4e6a-b4cf-7c8384e72182", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-04-23T14:47:52+00:00\nLast Submission: 2026-04-23T17:50:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "ssdeep", "timestamp": "1784340020", "to_ids": true, "type": "ssdeep", "uuid": "653e4306-4c02-4eaf-8b94-0e69f23538d9", "value": "49152:+X493lgN/VtJ+JdcbCj5i7G3tN+oScm5/:+LubSt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340020", "to_ids": false, "type": "size-in-bytes", "uuid": "7a7561d7-d9f0-46af-a9e3-38dbde38e73e", "value": "630721736" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "vhash", "timestamp": "1784340020", "to_ids": true, "type": "vhash", "uuid": "18bd8bbe-9633-4742-b668-1dadc1ddc3d7", "value": "068086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:47:52+00:00", "last_seen": "2026-04-23T17:50:20+00:00", "object_relation": "filename", "timestamp": "1784340020", "to_ids": true, "type": "filename", "uuid": "3610bbf7-c10c-4a1d-a682-2be29b1a0d71", "value": "CanvaPro_Desktop.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346416", "uuid": "ef4d4334-13df-4043-a2ba-1f0474fb50ac", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "md5", "timestamp": "1784346416", "to_ids": true, "type": "md5", "uuid": "74fb0131-b9ba-4f5c-af01-082f86b651ff", "value": "198c56d89a31c42f9f596b068938b4e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "sha1", "timestamp": "1784344437", "to_ids": true, "type": "sha1", "uuid": "ce70e9c2-7c86-41dd-8764-bb45cb3f4444", "value": "929b693d9bd666e2153800aea326e8cba8ee2d0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "sha256", "timestamp": "1784344437", "to_ids": true, "type": "sha256", "uuid": "eedc7d39-a527-41c7-b716-c3438deb5a4d", "value": "314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "text", "timestamp": "1784340042", "to_ids": false, "type": "text", "uuid": "bf087f39-0b12-4709-8a0c-409d7df84ef1", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 50/74\nFirst Submission: 2026-04-21T18:27:31+00:00\nLast Submission: 2026-04-25T21:41:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "ssdeep", "timestamp": "1784340042", "to_ids": true, "type": "ssdeep", "uuid": "230d7cf1-8a59-4db0-b6f2-714124b797c7", "value": "24576:ynskki4UVJfysieZQeM/G3AxqmGFWPHn8:ysNgfjZ5uc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340042", "to_ids": false, "type": "size-in-bytes", "uuid": "1dcad99f-4e37-4a85-b816-cd9a7459a2b7", "value": "1583304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "vhash", "timestamp": "1784340042", "to_ids": true, "type": "vhash", "uuid": "84ff7ad5-43fb-43c0-be69-7ca3b4e880b1", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T18:27:31+00:00", "last_seen": "2026-04-25T21:41:03+00:00", "object_relation": "filename", "timestamp": "1784340042", "to_ids": true, "type": "filename", "uuid": "3d73c515-baf4-4363-beee-eed932b3480b", "value": "shz_ac1dd.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346437", "uuid": "303f6255-f5f8-4751-91e4-1cec5b894da7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "md5", "timestamp": "1784346437", "to_ids": true, "type": "md5", "uuid": "a6358041-336f-41d2-ac54-a214505bc037", "value": "bdb661e21f0424f23a10c1a96c326bac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "sha1", "timestamp": "1784344438", "to_ids": true, "type": "sha1", "uuid": "55ab715e-63f9-45e8-be69-22faffc3910c", "value": "986e6771aff570998229bb23f17d65481aaf2921", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "sha256", "timestamp": "1784344438", "to_ids": true, "type": "sha256", "uuid": "780e458e-ad38-414a-9872-7ada4f2d2d87", "value": "32172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "text", "timestamp": "1784340063", "to_ids": false, "type": "text", "uuid": "28d43583-e15a-4066-9d16-ec8feacf32d9", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-22T19:04:00+00:00\nFirst Submission: 2026-04-22T18:03:55+00:00\nLast Submission: 2026-04-23T08:42:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "ssdeep", "timestamp": "1784340063", "to_ids": true, "type": "ssdeep", "uuid": "42bcfc43-ce3d-414d-a8ec-daaeffd4f97f", "value": "49152:Xc1b+zxvtn67dWOcA4kxEtdq6D/szECq3z5zqO/c:X4Y/szEv3z5Lc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340063", "to_ids": false, "type": "size-in-bytes", "uuid": "3bdf640c-1e61-4c68-9243-69231897a102", "value": "2375368" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "vhash", "timestamp": "1784340063", "to_ids": true, "type": "vhash", "uuid": "26ce02b3-7168-4c8d-877c-549e1b692c05", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:03:55+00:00", "last_seen": "2026-04-23T08:42:21+00:00", "object_relation": "filename", "timestamp": "1784340063", "to_ids": true, "type": "filename", "uuid": "c4b58c9f-9614-4457-b639-b49484f047c4", "value": "FixBootsrappperO.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346458", "uuid": "81fb92d6-06c0-4469-b1cd-f19fea1b8df2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "md5", "timestamp": "1784346458", "to_ids": true, "type": "md5", "uuid": "f74899d1-25e8-4147-827c-e2c68204ef03", "value": "a1037dcc0a8b6e6057cb079039cfe4ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "sha1", "timestamp": "1784344439", "to_ids": true, "type": "sha1", "uuid": "2962ed8f-3c1c-4404-85da-36c4ed479163", "value": "8303be37005a967c6c40eb178c6dbb12aecac1f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "sha256", "timestamp": "1784344440", "to_ids": true, "type": "sha256", "uuid": "cb6fcd7a-eb28-46bc-8194-9cf0f57ab52b", "value": "330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "text", "timestamp": "1784340085", "to_ids": false, "type": "text", "uuid": "91351851-e05f-4423-a2ec-74a9fa3a040c", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-04-23T13:30:34+00:00\nLast Submission: 2026-04-28T00:08:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "ssdeep", "timestamp": "1784340085", "to_ids": true, "type": "ssdeep", "uuid": "b2d74682-c1ea-49a8-9252-e13b260e042c", "value": "24576:cGx66acb8kpwmCT1wbPqL6Up1HPODrS8D0/peG1b4rqjzqG6WcR73DUzR:cGtJbajT1wDqL6Up1vOnS8D0l1LfOV32" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340085", "to_ids": false, "type": "size-in-bytes", "uuid": "a63cab8d-b3f8-44c8-91a7-f0a3a197b5c5", "value": "1979080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "vhash", "timestamp": "1784340085", "to_ids": true, "type": "vhash", "uuid": "9ef8ae7f-ba40-4166-8ed9-ef1dcc41364c", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:30:34+00:00", "last_seen": "2026-04-28T00:08:47+00:00", "object_relation": "filename", "timestamp": "1784340085", "to_ids": true, "type": "filename", "uuid": "a1f4e6ea-81fb-4649-b251-74ed52712358", "value": "Remus.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346479", "uuid": "d530c864-870b-4225-b807-858dba8dc3a3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "md5", "timestamp": "1784346479", "to_ids": true, "type": "md5", "uuid": "9f42072c-65ba-4c96-bb8e-687d56c64228", "value": "50807441b09c7420b9ccc8aad3a45ba4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "sha1", "timestamp": "1784344442", "to_ids": true, "type": "sha1", "uuid": "fef17d82-01e1-4a41-a3ef-2b0775eba06a", "value": "2c5a2aa7fb5393b42d52e86e4aa579ed993c7a17", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "sha256", "timestamp": "1784344442", "to_ids": true, "type": "sha256", "uuid": "bd2fa76e-33ba-428b-a658-7ce2fc2c83ef", "value": "35b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "text", "timestamp": "1784340106", "to_ids": false, "type": "text", "uuid": "75ab9321-f89c-45ac-b86a-c920bcd98327", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-23T07:41:33+00:00\nFirst Submission: 2026-04-23T05:41:13+00:00\nLast Submission: 2026-04-23T17:44:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "ssdeep", "timestamp": "1784340106", "to_ids": true, "type": "ssdeep", "uuid": "ba46ed36-fa02-49e2-baca-b9ea47a4d6cf", "value": "49152:WHUHlvTjd5kFKd/s4j98/BeW7rhfzd8Yqlmws8:WsQIyfzxws8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340106", "to_ids": false, "type": "size-in-bytes", "uuid": "2a84db69-ce71-467d-aa4d-2fc9f794b588", "value": "2398216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "vhash", "timestamp": "1784340106", "to_ids": true, "type": "vhash", "uuid": "7bb79d97-fd4e-479b-8def-57d605dc4872", "value": "1261376d1565551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T05:41:13+00:00", "last_seen": "2026-04-23T17:44:15+00:00", "object_relation": "filename", "timestamp": "1784340106", "to_ids": true, "type": "filename", "uuid": "3a7a6664-792f-465b-94d6-3acd2dbd8593", "value": "r6qdm2w1g.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346500", "uuid": "983a82fa-8666-46b9-b461-cb63004061a2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "md5", "timestamp": "1784346500", "to_ids": true, "type": "md5", "uuid": "0f9658ca-e97e-49b1-b7cf-c74cd3f7dfc5", "value": "70b1e10d1663bfb19af1b650011243a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "sha1", "timestamp": "1784344443", "to_ids": true, "type": "sha1", "uuid": "ecd3025e-395d-48bf-927b-cde115e8c183", "value": "fe02ffcd5954ceda1d1f97b55677dc12bee0d7e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "sha256", "timestamp": "1784344443", "to_ids": true, "type": "sha256", "uuid": "d044a83b-b1b9-4ade-b624-cbf413649799", "value": "35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "text", "timestamp": "1784340128", "to_ids": false, "type": "text", "uuid": "8062a84f-b7b0-492e-a346-9b91e744cdae", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2026-04-16T14:44:05+00:00\nLast Submission: 2026-04-19T02:52:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "ssdeep", "timestamp": "1784340128", "to_ids": true, "type": "ssdeep", "uuid": "614af162-b021-43ad-ba2e-50e9c65e0a60", "value": "24576:ygfLS9O67XrG32nwfCxvDuuYsncl13/uDC+dFx0Fhele5n92ycI4uxcDuJ:yC+Y6XG3ijbYsnc332uC2r1qD6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340128", "to_ids": false, "type": "size-in-bytes", "uuid": "c2d694ca-a603-4073-b1f6-536c6f44fc4b", "value": "1831552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "vhash", "timestamp": "1784340128", "to_ids": true, "type": "vhash", "uuid": "77a5a212-fe51-47e2-b6cd-f89336651d20", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T14:44:05+00:00", "last_seen": "2026-04-19T02:52:32+00:00", "object_relation": "filename", "timestamp": "1784340128", "to_ids": true, "type": "filename", "uuid": "f12ccb1d-0239-4bb2-bd18-4be1cb4ba43b", "value": "V\u0169_Manager.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346521", "uuid": "ac5dbc1d-e44c-4019-9d64-750e7d3e2557", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "md5", "timestamp": "1784346521", "to_ids": true, "type": "md5", "uuid": "70a2afc3-f513-4ae8-b8a5-1f1876ae71fa", "value": "84b7baaa2e134146258d883388114f18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "sha1", "timestamp": "1784344444", "to_ids": true, "type": "sha1", "uuid": "d00189a6-6cec-4f88-b0c7-6b8ce65cb471", "value": "91f2324c19f08256d45bfc675a80efd6ad1e8748", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "sha256", "timestamp": "1784344444", "to_ids": true, "type": "sha256", "uuid": "25828016-a723-4e2c-a321-922070468dfc", "value": "3c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb913", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "text", "timestamp": "1784340150", "to_ids": false, "type": "text", "uuid": "0407bd1a-bb44-4e39-b409-23d985329ae8", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-23T18:35:27+00:00\nFirst Submission: 2026-04-23T23:43:23+00:00\nLast Submission: 2026-04-23T23:43:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "ssdeep", "timestamp": "1784340150", "to_ids": true, "type": "ssdeep", "uuid": "a4217c3c-1adb-4567-837b-e72bfecbc376", "value": "49152:wuGIVgBM64FTkw5Y/XeWbqRRpxqJIW+mpOSOOR2:wpywJITmpBd2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340150", "to_ids": false, "type": "size-in-bytes", "uuid": "e5c91b38-1b74-410a-b612-f2ba59631fdd", "value": "2381000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "vhash", "timestamp": "1784340150", "to_ids": true, "type": "vhash", "uuid": "f7bbb767-2689-4475-a878-1c2c5d34cad0", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T23:43:23+00:00", "last_seen": "2026-04-23T23:43:23+00:00", "object_relation": "filename", "timestamp": "1784340150", "to_ids": true, "type": "filename", "uuid": "a38fcb8a-9b10-45fd-b8d2-367ae63ab6b4", "value": "2tr1r8.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346543", "uuid": "676baa78-1f13-4408-a07f-70363222d0b3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "md5", "timestamp": "1784346543", "to_ids": true, "type": "md5", "uuid": "a67063fd-bade-462f-8b9b-68040409265e", "value": "9d0c09b2efebdc82b86f9e268cac0e21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "sha1", "timestamp": "1784344445", "to_ids": true, "type": "sha1", "uuid": "cca3f81c-0150-459f-a6fd-687392f7d70d", "value": "d3e53c5739fa5e12d50e898f9143789f3a39ae6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "sha256", "timestamp": "1784344446", "to_ids": true, "type": "sha256", "uuid": "e2335661-7299-48fd-a439-af70edc20dc8", "value": "3db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "text", "timestamp": "1784340171", "to_ids": false, "type": "text", "uuid": "b6cde193-7427-424a-aac1-f546c6949dbb", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-22T11:12:37+00:00\nFirst Submission: 2026-04-22T09:10:58+00:00\nLast Submission: 2026-04-24T12:26:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "ssdeep", "timestamp": "1784340171", "to_ids": true, "type": "ssdeep", "uuid": "636ceba2-788d-48b9-80bc-d33b0c59d339", "value": "49152:b8KxwNvS29EJYqrWtrJHlpI6sHIzZabvXZ:b8g0LE9iSHIz2Z" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340171", "to_ids": false, "type": "size-in-bytes", "uuid": "e28e88f6-de1b-444a-a0cc-509622a0e2ba", "value": "2214600" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "vhash", "timestamp": "1784340171", "to_ids": true, "type": "vhash", "uuid": "8731a186-fed8-4b99-9c48-fb965bfc3934", "value": "026086656d15551d15545az2f!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:10:58+00:00", "last_seen": "2026-04-24T12:26:50+00:00", "object_relation": "filename", "timestamp": "1784340171", "to_ids": true, "type": "filename", "uuid": "e76f3926-98c0-4fd0-881f-3b3665df4ab8", "value": "Setup (4).exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346564", "uuid": "19a443fa-9cf7-43b3-afea-af3c560179d7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "md5", "timestamp": "1784346564", "to_ids": true, "type": "md5", "uuid": "ac18f99d-f781-44b0-b8b5-aa0f25b53687", "value": "98c2943417a1e3291965c32f13fa1f5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "sha1", "timestamp": "1784344447", "to_ids": true, "type": "sha1", "uuid": "e0ab41c7-5a72-4bf6-9195-dd4ba2c5396b", "value": "d6dd9a9de02b0b26befd82e0aca751306080e025", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "sha256", "timestamp": "1784344447", "to_ids": true, "type": "sha256", "uuid": "8964bd43-14b1-4372-bb9f-f7e23e40ea96", "value": "43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f581", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "text", "timestamp": "1784340193", "to_ids": false, "type": "text", "uuid": "53eea5d5-f293-4b55-86cb-ab16c3fa5d5d", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-16T01:09:31+00:00\nFirst Submission: 2026-04-15T20:10:11+00:00\nLast Submission: 2026-04-15T20:10:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "ssdeep", "timestamp": "1784340193", "to_ids": true, "type": "ssdeep", "uuid": "fef8d32d-3b24-401e-8cb8-ccc1dd30b8eb", "value": "24576:PnotHnFyP20acyQVAPexZ032vqe8oxj5r+evTrOzKqxrtBc0I++PfnJkGvNTBely:PnotHg+AyQ2exJM8jdrQVNIdPmG+1Y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340193", "to_ids": false, "type": "size-in-bytes", "uuid": "a6cb65b3-d77a-4053-92f7-1d4dc906e28b", "value": "2453632" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "vhash", "timestamp": "1784340193", "to_ids": true, "type": "vhash", "uuid": "5b5d9cf0-daa5-4456-9e26-2bb0af7c8497", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:10:11+00:00", "last_seen": "2026-04-15T20:10:11+00:00", "object_relation": "filename", "timestamp": "1784340193", "to_ids": true, "type": "filename", "uuid": "2dab323c-acaa-4aff-8c10-c3c05d6b0f28", "value": "dw.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346585", "uuid": "d791a93f-76a0-44bf-a29e-73052d4d6c14", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "md5", "timestamp": "1784346585", "to_ids": true, "type": "md5", "uuid": "502be481-f9f1-4e99-bc59-d5f0e424c89d", "value": "039d7ae2130b2e3ab766010ae89e2d55", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "sha1", "timestamp": "1784344448", "to_ids": true, "type": "sha1", "uuid": "5f471ed6-acc5-4ada-8d42-999647068545", "value": "274b989eb5bb8d8252501933e2d03945c36ba07a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "sha256", "timestamp": "1784344448", "to_ids": true, "type": "sha256", "uuid": "da750d56-ef39-4ae8-9aa6-56de201d8c7c", "value": "47d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "text", "timestamp": "1784340214", "to_ids": false, "type": "text", "uuid": "ae4112c3-3986-422a-a871-4b2fef628183", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-16T12:33:50+00:00\nFirst Submission: 2026-04-16T11:33:35+00:00\nLast Submission: 2026-04-16T19:13:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "ssdeep", "timestamp": "1784340214", "to_ids": true, "type": "ssdeep", "uuid": "c19deb30-b608-4533-8c34-1cbe14d26ff2", "value": "24576:mj8u5nHSuvFOwg4xQb2CR56IO83+MF8WMEvBvEMcpwSa85FNTBele5y92XUIH3yA:mYupyuwX4+3yI1+cMUKwdnyvd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340214", "to_ids": false, "type": "size-in-bytes", "uuid": "808ccf69-4285-4416-b355-81cff88acb28", "value": "2442880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "vhash", "timestamp": "1784340214", "to_ids": true, "type": "vhash", "uuid": "af50b5d8-00cb-4312-93fa-f19d0e48d25b", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T11:33:35+00:00", "last_seen": "2026-04-16T19:13:11+00:00", "object_relation": "filename", "timestamp": "1784340214", "to_ids": true, "type": "filename", "uuid": "7300ea93-b8da-4531-b715-c0bffc00a2c5", "value": "drqk6y.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346607", "uuid": "f7969404-f7fb-436d-b3e7-db36aa0b3737", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "md5", "timestamp": "1784346607", "to_ids": true, "type": "md5", "uuid": "9dc98f09-70cc-452a-9ac5-d4bfa7063852", "value": "7411167f3e5364ecb3080f981f9770f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "sha1", "timestamp": "1784344449", "to_ids": true, "type": "sha1", "uuid": "505ff715-49d2-4707-a892-43a7d0d22418", "value": "3569339ea1c6839c8e708671374fb0ce19874112", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "sha256", "timestamp": "1784344450", "to_ids": true, "type": "sha256", "uuid": "ebf0c0a8-734f-443c-b55d-584a1e0e8641", "value": "488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "text", "timestamp": "1784340236", "to_ids": false, "type": "text", "uuid": "71f41991-762f-494b-bbb1-eabd0f11f1e6", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:02 AM 07/15/2026\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-16T05:43:03+00:00\nFirst Submission: 2026-04-16T03:41:48+00:00\nLast Submission: 2026-04-16T03:41:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "ssdeep", "timestamp": "1784340236", "to_ids": true, "type": "ssdeep", "uuid": "51aba2fe-15bd-43fe-8b9c-068d59e743f4", "value": "49152:rB3UECYI22b4Qjv739p5dUjKsgXxY3Eesn:rBkVd4Q/39oMu1sn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340236", "to_ids": false, "type": "size-in-bytes", "uuid": "0e6d5ad4-1462-4934-ae98-b947cbcf401a", "value": "2601808" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "vhash", "timestamp": "1784340236", "to_ids": true, "type": "vhash", "uuid": "a9aeec47-525d-42a4-b193-a0ae3afb6b66", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T03:41:48+00:00", "last_seen": "2026-04-16T03:41:48+00:00", "object_relation": "filename", "timestamp": "1784340236", "to_ids": true, "type": "filename", "uuid": "b26b90da-d786-4a24-b419-925dfc6b4f0b", "value": "it4jcfsd.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346628", "uuid": "d05ff734-c150-4e03-a3ca-db6ecfbd3556", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "md5", "timestamp": "1784346628", "to_ids": true, "type": "md5", "uuid": "5baa5008-7ba1-4582-a808-02bed03c458a", "value": "cc8e03f4e52a838214654047f3e8c648", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "sha1", "timestamp": "1784344451", "to_ids": true, "type": "sha1", "uuid": "debb0c07-dde2-4afc-918e-1025ea6ecf47", "value": "3b40daed569db048b119b540379caa68b6142da2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "sha256", "timestamp": "1784344451", "to_ids": true, "type": "sha256", "uuid": "fa7f609e-3844-4298-a6e3-8259b54d1ea7", "value": "4bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c5394252436", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "text", "timestamp": "1784340257", "to_ids": false, "type": "text", "uuid": "04e5e6b5-77c4-4332-b8d0-9aabb94602c3", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-22T03:17:44+00:00\nFirst Submission: 2026-04-21T22:35:27+00:00\nLast Submission: 2026-04-23T18:36:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "ssdeep", "timestamp": "1784340257", "to_ids": true, "type": "ssdeep", "uuid": "ab3a63c4-d4d5-4950-ba19-92d7cd65305a", "value": "49152:yNpL1UkGFUslkYTGUqSYBuCka/WNGk/+YvSOjX:y1/WR+YvrX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340257", "to_ids": false, "type": "size-in-bytes", "uuid": "f85ae29e-5550-46b2-ba9e-ae7e03e30200", "value": "2366664" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "vhash", "timestamp": "1784340257", "to_ids": true, "type": "vhash", "uuid": "2f496d0f-553b-43ab-8bca-7f637217f9ef", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T22:35:27+00:00", "last_seen": "2026-04-23T18:36:51+00:00", "object_relation": "filename", "timestamp": "1784340257", "to_ids": true, "type": "filename", "uuid": "fd373c3d-3411-43f5-b24b-8515bd6b366e", "value": "Bootstapper.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346650", "uuid": "e72f348a-430a-4129-a48c-ebf2ab39b2ba", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "md5", "timestamp": "1784346650", "to_ids": true, "type": "md5", "uuid": "9284d5ee-23b7-4da1-95c6-5f873fcb67fb", "value": "e3b38cd5735d088dc436b487b04450c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "sha1", "timestamp": "1784344452", "to_ids": true, "type": "sha1", "uuid": "608d24dc-444d-4951-b326-69b3cd5a603f", "value": "775218b31c5b6eac6fbe918a8b46a7f165a7292f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "sha256", "timestamp": "1784344452", "to_ids": true, "type": "sha256", "uuid": "5bf885bb-11c5-43a7-b1aa-a9bc73b6b5f3", "value": "4f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d01542626", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "text", "timestamp": "1784340279", "to_ids": false, "type": "text", "uuid": "9f050f67-5c0b-417b-ab70-ee7935fae3e6", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-24T12:16:53+00:00\nFirst Submission: 2026-04-24T04:48:16+00:00\nLast Submission: 2026-04-28T13:52:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "ssdeep", "timestamp": "1784340279", "to_ids": true, "type": "ssdeep", "uuid": "582d1e39-3b69-40f5-868c-38380cc43ce0", "value": "49152:u2OTQwui/7C0s6NaF1x3CsEDmQ3s6TyqBOmU:u21CCBb8U" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340279", "to_ids": false, "type": "size-in-bytes", "uuid": "c0781133-d2f0-4c6f-8fe5-c1ab9787accf", "value": "1970376" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "vhash", "timestamp": "1784340279", "to_ids": true, "type": "vhash", "uuid": "257aef4c-ecb3-43a6-9d81-38b3958a3a86", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:48:16+00:00", "last_seen": "2026-04-28T13:52:36+00:00", "object_relation": "filename", "timestamp": "1784340279", "to_ids": true, "type": "filename", "uuid": "1a66cfd3-966d-4ff9-a384-ad5bdc2d5bef", "value": "InstallerX64.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346671", "uuid": "8dcf782b-6a07-4cd1-9fb5-007bc1d8dd39", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "md5", "timestamp": "1784346671", "to_ids": true, "type": "md5", "uuid": "b233e2c4-b3a7-4456-88d2-e0c9a64007ea", "value": "ed540fcd5b58768977f31ec14808d46c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "sha1", "timestamp": "1784344453", "to_ids": true, "type": "sha1", "uuid": "3bfcb4e5-d668-4308-adc8-83f0402d0f53", "value": "bace0ad5bef7e314fa3c300d8ebc6c10beaa03b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "sha256", "timestamp": "1784344453", "to_ids": true, "type": "sha256", "uuid": "fdd262bb-71bf-4111-ba70-a81d0be6f907", "value": "54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "text", "timestamp": "1784340300", "to_ids": false, "type": "text", "uuid": "11f538f8-5ed4-428e-85c9-a452dac28471", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: None\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2026-04-22T09:26:53+00:00\nLast Submission: 2026-06-11T16:40:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "ssdeep", "timestamp": "1784340300", "to_ids": true, "type": "ssdeep", "uuid": "821da890-4e65-4c2e-8956-6a12a3409023", "value": "49152:cDdlPPEm7bvm+itjZJiE7Y0LvLcxSkWmldYF+aIRY:cb4Diw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340300", "to_ids": false, "type": "size-in-bytes", "uuid": "55d7de79-d4a9-447d-95a4-afba3fd66a5e", "value": "107202768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "vhash", "timestamp": "1784340300", "to_ids": true, "type": "vhash", "uuid": "e5981260-11d8-48dc-9e43-53b071666687", "value": "018086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:26:53+00:00", "last_seen": "2026-06-11T16:40:57+00:00", "object_relation": "filename", "timestamp": "1784340300", "to_ids": true, "type": "filename", "uuid": "13bc161c-400a-453b-9b0f-7945e1697312", "value": "\u6ee5\u7528\u5efa\u8bae\u8170\u5e26.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346692", "uuid": "70d37d81-5221-4231-adca-3ed9051963cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "md5", "timestamp": "1784346692", "to_ids": true, "type": "md5", "uuid": "bda866eb-d4ac-4cab-b260-d0b450ece99a", "value": "97d209214b966957c7010f4d4989da07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "sha1", "timestamp": "1784344454", "to_ids": true, "type": "sha1", "uuid": "51e1d2b9-c69b-42bc-9bed-70f907a04516", "value": "b5c9fe30cf7ab9c3098fda632a92ce87a1a4ffe6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "sha256", "timestamp": "1784344454", "to_ids": true, "type": "sha256", "uuid": "4d5d0bc5-c060-4520-a4fe-3d8eae43210a", "value": "559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a3815", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "text", "timestamp": "1784340323", "to_ids": false, "type": "text", "uuid": "99b3bb96-0b01-4f97-8e98-e04c283a1459", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-21T11:48:09+00:00\nFirst Submission: 2026-04-21T10:48:00+00:00\nLast Submission: 2026-05-10T14:06:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "ssdeep", "timestamp": "1784340323", "to_ids": true, "type": "ssdeep", "uuid": "d029d6b3-2839-47bd-a728-dc6abcaf9324", "value": "49152:Z7yAFz6k8o9Djhht4mlgAvTiqNOP6y+BvX:Z7dRAYhhBlHvTiB+l" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340323", "to_ids": false, "type": "size-in-bytes", "uuid": "6fead110-7582-4075-8377-414f03248c9e", "value": "7441616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "vhash", "timestamp": "1784340323", "to_ids": true, "type": "vhash", "uuid": "52405914-59f0-46ab-8ab3-995e137a261e", "value": "076086656d15551d15545az2f!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T10:48:00+00:00", "last_seen": "2026-05-10T14:06:50+00:00", "object_relation": "filename", "timestamp": "1784340323", "to_ids": true, "type": "filename", "uuid": "c0fb1e22-3569-44ec-b768-92f3ce274c0d", "value": "autoplay.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346713", "uuid": "726ebe33-5c4f-4c18-992e-0b759abc92e7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "md5", "timestamp": "1784346713", "to_ids": true, "type": "md5", "uuid": "1b717247-08ee-42f5-8df1-a6bbf3e36bc6", "value": "58a6d0dbdb232a1336ea0a43a0575960", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "sha1", "timestamp": "1784344456", "to_ids": true, "type": "sha1", "uuid": "5541de46-d057-42b9-9039-7640d1992eb3", "value": "4630c77b685535c2d540d57ea29ca0db1f395aad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "sha256", "timestamp": "1784344456", "to_ids": true, "type": "sha256", "uuid": "e6078ae3-ed93-4cbc-8aac-f6f645b58988", "value": "59b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "text", "timestamp": "1784340365", "to_ids": false, "type": "text", "uuid": "67bc1c7f-46f6-42a4-b260-09cd5a48f0ba", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-23T02:40:46+00:00\nFirst Submission: 2026-04-23T01:40:39+00:00\nLast Submission: 2026-04-25T15:24:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "ssdeep", "timestamp": "1784340365", "to_ids": true, "type": "ssdeep", "uuid": "3599dd0d-3dc6-421d-8f82-da33c1f6e6cb", "value": "49152:C4PnEK/SJFwlsgK5XhqsRtwNsYflk5j+m3ze2yOBHW:CgLTfO5j+mDeGW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340365", "to_ids": false, "type": "size-in-bytes", "uuid": "8799da89-a9a8-47cb-8791-7b55b0f0202b", "value": "2371272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "vhash", "timestamp": "1784340365", "to_ids": true, "type": "vhash", "uuid": "9624a098-6c00-4c91-9257-b31c9c6ccdd5", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T01:40:39+00:00", "last_seen": "2026-04-25T15:24:13+00:00", "object_relation": "filename", "timestamp": "1784340365", "to_ids": true, "type": "filename", "uuid": "34d8dce6-db62-4e88-ab07-9858853dd7c3", "value": "Setup.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346734", "uuid": "1ee4144f-c02b-4a87-85c7-7c89a36313d0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "md5", "timestamp": "1784346734", "to_ids": true, "type": "md5", "uuid": "14c43d2e-cfa0-43e6-8033-c10e63c22cf8", "value": "4acac6241c68bb7ebb915c42573221a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "sha1", "timestamp": "1784344456", "to_ids": true, "type": "sha1", "uuid": "c818f33d-2d7f-4a3c-9556-6f67bafae46d", "value": "2501e4c8b6545d09d56abc6384ff4f93055b0291", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "sha256", "timestamp": "1784344457", "to_ids": true, "type": "sha256", "uuid": "2360bc5b-0b5b-40fa-b51f-b3108df1ad4a", "value": "5b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb691", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "text", "timestamp": "1784340387", "to_ids": false, "type": "text", "uuid": "655bff44-257a-446d-b50e-eda40b1295b6", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Submission: 2026-04-22T09:54:18+00:00\nLast Submission: 2026-04-23T16:23:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "ssdeep", "timestamp": "1784340387", "to_ids": true, "type": "ssdeep", "uuid": "2382791c-8840-4630-b089-7d4aeb983ef1", "value": "49152:n6w8lyBxsqrTpJ9qXmRBKurV29DKxO/7vTO2C:nvV29DKUTv3C" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340387", "to_ids": false, "type": "size-in-bytes", "uuid": "9e81eb02-4510-4d9d-ab4a-8d0ec508d529", "value": "1973448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "vhash", "timestamp": "1784340387", "to_ids": true, "type": "vhash", "uuid": "994fdd7c-e765-4a64-8816-27d1a97e73ec", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T09:54:18+00:00", "last_seen": "2026-04-23T16:23:34+00:00", "object_relation": "filename", "timestamp": "1784340387", "to_ids": true, "type": "filename", "uuid": "018f2139-70be-47d1-ba61-3dd022860117", "value": "4bolaa.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346756", "uuid": "b2794b80-3023-4c06-ab22-08f3dba97ecc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "md5", "timestamp": "1784346756", "to_ids": true, "type": "md5", "uuid": "a5b573e9-461a-49c1-8523-544ecd3092ab", "value": "b95bab58174a0c6fa035aa5ad8ffe522", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "sha1", "timestamp": "1784344458", "to_ids": true, "type": "sha1", "uuid": "0cfef7b8-2d17-4b7c-b861-817fce9c0871", "value": "349261d0ba2043edfeb5f68845675c48bf4d5aa2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "sha256", "timestamp": "1784344458", "to_ids": true, "type": "sha256", "uuid": "539f3275-365e-4894-8a3d-5e89ad6c8e83", "value": "5d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "text", "timestamp": "1784340408", "to_ids": false, "type": "text", "uuid": "8d94bba5-7843-4c06-9118-0eb74ee80658", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2026-05-14T00:08:08+00:00\nFirst Submission: 2026-04-15T16:49:03+00:00\nLast Submission: 2026-04-15T17:17:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "ssdeep", "timestamp": "1784340408", "to_ids": true, "type": "ssdeep", "uuid": "778d9ea9-8066-4cd4-bcb4-3d28e92b422e", "value": "49152:KdQALqkTkwBPcW5Yq0ENBmodizL2bUA00NECKsx:KhLZX+Wh0ENB+L2wAHKsx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340408", "to_ids": false, "type": "size-in-bytes", "uuid": "4c588a03-23d4-4515-996e-4e786caace2d", "value": "2562640" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "vhash", "timestamp": "1784340408", "to_ids": true, "type": "vhash", "uuid": "a9c1f7e6-358d-45e6-baed-73541f534deb", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:49:03+00:00", "last_seen": "2026-04-15T17:17:31+00:00", "object_relation": "filename", "timestamp": "1784340408", "to_ids": true, "type": "filename", "uuid": "aa08f4b7-5071-4596-b216-81257b7bd16e", "value": "ymkx64s.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346777", "uuid": "905fb744-6c22-46fe-980e-f0640a733063", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "md5", "timestamp": "1784346777", "to_ids": true, "type": "md5", "uuid": "1fce3640-4533-48be-b73f-58659ee8b277", "value": "4f43de529dda98f3672477865cf466ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "sha1", "timestamp": "1784344459", "to_ids": true, "type": "sha1", "uuid": "35a30628-e6d0-4f00-974f-e2ea0c2257d6", "value": "8cdb174170008f5d06355540c53faa59d0e9d03a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "sha256", "timestamp": "1784344459", "to_ids": true, "type": "sha256", "uuid": "ea597429-c1f6-466c-9119-2b8c67ad1254", "value": "62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "text", "timestamp": "1784340430", "to_ids": false, "type": "text", "uuid": "b7a4c903-2b52-44f5-91ab-24e750edfde8", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:02 AM 07/15/2026\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-23T18:31:20+00:00\nFirst Submission: 2026-04-23T17:31:11+00:00\nLast Submission: 2026-04-23T20:18:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "ssdeep", "timestamp": "1784340430", "to_ids": true, "type": "ssdeep", "uuid": "d62e902e-7f76-40d7-a0b2-577d511b522a", "value": "49152:G4PnEK/u2aq57c6boUDM5Hgj8m4eiPFQAkoO/Oj0r:GgY6CQxo1Q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340430", "to_ids": false, "type": "size-in-bytes", "uuid": "3b48769e-baf9-423a-94c1-e55b88e400b6", "value": "7614160" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "vhash", "timestamp": "1784340430", "to_ids": true, "type": "vhash", "uuid": "3ef5ac09-125a-4592-8f3b-6f3705776250", "value": "076086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T17:31:11+00:00", "last_seen": "2026-04-23T20:18:24+00:00", "object_relation": "filename", "timestamp": "1784340430", "to_ids": true, "type": "filename", "uuid": "64151fb4-8c0a-47c6-b6f6-2222b4359a71", "value": "8f0kqeg.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346798", "uuid": "1326a57c-cd9e-4f02-8acf-a5a00cd902da", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "md5", "timestamp": "1784346798", "to_ids": true, "type": "md5", "uuid": "fd4155d3-a268-4600-8c04-80cf919f6af2", "value": "d62a21530838ae23e116b09fdca27dcc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "sha1", "timestamp": "1784344461", "to_ids": true, "type": "sha1", "uuid": "2b55a09b-697e-4076-8d9e-ce05b22de685", "value": "e9293c9f9ee4438821529075c44bc27c04cca2a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "sha256", "timestamp": "1784344461", "to_ids": true, "type": "sha256", "uuid": "f63642bd-6bc2-4dba-a0fc-5670c5a4ace6", "value": "739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "text", "timestamp": "1784340472", "to_ids": false, "type": "text", "uuid": "27073e4a-0e18-4f9b-892c-8b13b1632668", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-16T17:47:09+00:00\nFirst Submission: 2026-04-16T16:46:46+00:00\nLast Submission: 2026-07-09T12:07:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "ssdeep", "timestamp": "1784340472", "to_ids": true, "type": "ssdeep", "uuid": "fdd0dbb4-db56-4efc-ad55-aea8d6721620", "value": "24576:fZj6PKuyvWH7xEchbNqa8cQL/T9u3yzXsr4fG6Y51nEBGTaw1FLnAPBTBele5y9k:fZj6yuqWBpqpX/5rXhGnEBoLnZyH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340472", "to_ids": false, "type": "size-in-bytes", "uuid": "1221340f-30c8-4d82-98b3-7ed4e079a40c", "value": "2467968" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "vhash", "timestamp": "1784340472", "to_ids": true, "type": "vhash", "uuid": "f6d4b04c-5eaa-4f0e-b06f-7c6d518dae1e", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T16:46:46+00:00", "last_seen": "2026-07-09T12:07:43+00:00", "object_relation": "filename", "timestamp": "1784340472", "to_ids": true, "type": "filename", "uuid": "4ef34e63-fe37-4cae-bcc2-715d6680197d", "value": "setup.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346819", "uuid": "17869e65-2b3d-43fc-a59c-5ad813ed9005", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "md5", "timestamp": "1784346819", "to_ids": true, "type": "md5", "uuid": "659e31be-6cd8-4c58-b6f8-087e5a07947a", "value": "0a2088105544480b2a4f14fd937dea51", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "sha1", "timestamp": "1784344462", "to_ids": true, "type": "sha1", "uuid": "4be023e5-693d-45bf-aa2f-8ecfd2f23f3e", "value": "ec02f993219eb0afc11d74dc5b476cf06766e1c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "sha256", "timestamp": "1784344462", "to_ids": true, "type": "sha256", "uuid": "ea1ae365-c6e6-4d35-8991-3c133dab7af7", "value": "7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "text", "timestamp": "1784340493", "to_ids": false, "type": "text", "uuid": "1de3a2ce-8160-448a-8a74-27fdd203d0c7", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-15T21:53:10+00:00\nFirst Submission: 2026-04-15T16:43:02+00:00\nLast Submission: 2026-04-15T20:10:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "ssdeep", "timestamp": "1784340493", "to_ids": true, "type": "ssdeep", "uuid": "710fefe2-2b0a-4193-bfaf-3f28ebc33a1d", "value": "49152:U3O6aoDSXlC1GqsJkiJqyLOw/t8hvLRhErs7:UeoyCwqsJkAqyLOiGvLRhis7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340493", "to_ids": false, "type": "size-in-bytes", "uuid": "e466dbee-002a-450e-b7ce-19d0dae2aa64", "value": "2640128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "vhash", "timestamp": "1784340493", "to_ids": true, "type": "vhash", "uuid": "4c719e65-6cb5-4716-b73a-79374579dc03", "value": "1261376d1565551c051d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:43:02+00:00", "last_seen": "2026-04-15T20:10:59+00:00", "object_relation": "filename", "timestamp": "1784340493", "to_ids": true, "type": "filename", "uuid": "7bd6f3a7-703c-48b1-aabe-f47e822ed3a8", "value": "pydhyg.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346840", "uuid": "255394ae-6b1e-460b-9a3b-71da9f4713b3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "md5", "timestamp": "1784346840", "to_ids": true, "type": "md5", "uuid": "56e42529-5687-4803-bfb5-0b7d4d5ddea4", "value": "19ae84ad38d3b22fff730841a8cb3546", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "sha1", "timestamp": "1784344463", "to_ids": true, "type": "sha1", "uuid": "4f772cdd-dbc2-4364-b3b2-cd17fac38bad", "value": "08d1f5b2ae1ab09605ff38f18957b7ac288f00bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "sha256", "timestamp": "1784344463", "to_ids": true, "type": "sha256", "uuid": "5bc5ab7a-7dfe-46b9-867c-82ad80429b06", "value": "77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "text", "timestamp": "1784340515", "to_ids": false, "type": "text", "uuid": "0d564c26-ad6f-41b0-8250-dd6522ac6f58", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-22T19:08:30+00:00\nFirst Submission: 2026-04-22T18:08:06+00:00\nLast Submission: 2026-04-23T18:29:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "ssdeep", "timestamp": "1784340515", "to_ids": true, "type": "ssdeep", "uuid": "c99afd23-6920-4f3c-be68-d0faf2cc0a11", "value": "49152:Ji2jOYfgHLHpa/ulbgrwlJn0COmtOPf8/pK5u:JsOmEPfwZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340515", "to_ids": false, "type": "size-in-bytes", "uuid": "bfbc1052-4274-48de-877c-bd19f7787ac5", "value": "2628296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "vhash", "timestamp": "1784340515", "to_ids": true, "type": "vhash", "uuid": "666bedbd-48ad-4635-b62a-bd905c993701", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:08:06+00:00", "last_seen": "2026-04-23T18:29:02+00:00", "object_relation": "filename", "timestamp": "1784340515", "to_ids": true, "type": "filename", "uuid": "83ee5d8e-9df1-4092-a518-b1b6f0ec91de", "value": "jb7l1uuta.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346861", "uuid": "0c4c8500-772f-4d8f-abd2-6bc298dc0e16", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "md5", "timestamp": "1784346861", "to_ids": true, "type": "md5", "uuid": "8969ff81-9c6a-4989-8b39-3f7f2dcf0aee", "value": "16088ab41e9c11c2d0d839ca0f79330a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "sha1", "timestamp": "1784344465", "to_ids": true, "type": "sha1", "uuid": "d2514181-4d2d-4208-9843-2e08e07a0647", "value": "f239a999ebb99244abaceac3d8adcad21e63798c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "sha256", "timestamp": "1784344465", "to_ids": true, "type": "sha256", "uuid": "879ac509-046d-45f5-accf-2ad11f31833d", "value": "7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "text", "timestamp": "1784340537", "to_ids": false, "type": "text", "uuid": "1c3ddabb-31c6-4ef4-9a2a-40e19cfd5566", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-04-22T19:02:32+00:00\nFirst Submission: 2026-04-22T18:02:06+00:00\nLast Submission: 2026-04-23T08:43:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "ssdeep", "timestamp": "1784340537", "to_ids": true, "type": "ssdeep", "uuid": "3527572d-56ae-48d9-93d3-d8ce57e599d3", "value": "49152:90AO43Aiz/A2qMLQt/T8WnuAJ41me7FGJJsP7Zn7lqrWse:9W3uuamimW1nMWse" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340537", "to_ids": false, "type": "size-in-bytes", "uuid": "481f947f-539a-462b-8648-687f9dc7294c", "value": "2790928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "vhash", "timestamp": "1784340537", "to_ids": true, "type": "vhash", "uuid": "cfdfe356-c36f-4609-a1c6-030a94e60ca1", "value": "1261376d1575551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T18:02:06+00:00", "last_seen": "2026-04-23T08:43:14+00:00", "object_relation": "filename", "timestamp": "1784340537", "to_ids": true, "type": "filename", "uuid": "213cddde-b363-4959-b7ee-a0c269cf9314", "value": "b3taww.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346883", "uuid": "a1712822-883a-4546-af77-743dd4d49b2b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "md5", "timestamp": "1784346883", "to_ids": true, "type": "md5", "uuid": "515237a6-723c-442a-b876-bbb05ed3a169", "value": "7b4b5e6d66025612a41bedee45bc4f41", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "sha1", "timestamp": "1784344466", "to_ids": true, "type": "sha1", "uuid": "4c96332c-74ba-4df5-a2a4-5cfd4b8a8834", "value": "13fdef66ceb3b406e805a84d294dd4422975f51d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "sha256", "timestamp": "1784344466", "to_ids": true, "type": "sha256", "uuid": "4bac05be-8741-40e3-bc3c-84a25ec2fad9", "value": "7e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "text", "timestamp": "1784340558", "to_ids": false, "type": "text", "uuid": "24d812c8-d017-439c-a10b-38059dfed741", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-15T18:05:38+00:00\nFirst Submission: 2026-04-15T16:05:15+00:00\nLast Submission: 2026-04-15T16:05:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "ssdeep", "timestamp": "1784340558", "to_ids": true, "type": "ssdeep", "uuid": "01e1b214-edff-46c9-83f5-9919d3d096b0", "value": "49152:37Y2zp5JwD5ubcfkKlCOd0xFkGbnT3ePZRzsk:3MhFqOlCOWognzMDsk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340558", "to_ids": false, "type": "size-in-bytes", "uuid": "c00229d5-f82e-40ac-88a4-5c0896d38e9d", "value": "2591760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "vhash", "timestamp": "1784340558", "to_ids": true, "type": "vhash", "uuid": "d2e61e00-9229-4490-86f0-b6a54d671328", "value": "1261376d1565551c051d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T16:05:15+00:00", "last_seen": "2026-04-15T16:05:15+00:00", "object_relation": "filename", "timestamp": "1784340558", "to_ids": true, "type": "filename", "uuid": "f9106bc7-61b3-4683-87f4-05ebbd298bf9", "value": "qt23n7.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346904", "uuid": "f9eba884-1ad1-45cd-b5b4-4fc249242c1a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "md5", "timestamp": "1784346904", "to_ids": true, "type": "md5", "uuid": "85ad466c-7e42-4a43-9c05-7c0256084a67", "value": "ccb8be3f5b2e9dcf0f0b2ac8399656a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "sha1", "timestamp": "1784344467", "to_ids": true, "type": "sha1", "uuid": "0e732ba4-4b13-4e97-bc53-43a9e7c1dda1", "value": "6a50b2018500c128cdd8941363b7531056bef8f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "sha256", "timestamp": "1784344467", "to_ids": true, "type": "sha256", "uuid": "70fb7ead-4560-45a7-8e66-87b9b738d9fb", "value": "8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f62", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "text", "timestamp": "1784340579", "to_ids": false, "type": "text", "uuid": "d6c75423-ddf3-45e0-9c39-3b3fba3cb84a", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 45/74\nFirst Submission: 2026-04-16T15:41:00+00:00\nLast Submission: 2026-04-16T15:41:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "ssdeep", "timestamp": "1784340579", "to_ids": true, "type": "ssdeep", "uuid": "1b1589ef-e7cd-4b67-9cad-bd8afbbe97ba", "value": "24576:RTa9f747t5KEKoWiwkhGFqHJ629vBA83v7LjJZQ0Fhele5n92ycLzYG:RTQz4nzKNihK2629v6yn9ZhrtG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340579", "to_ids": false, "type": "size-in-bytes", "uuid": "538494e2-ff24-4107-908f-417a28c55553", "value": "2217600" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "vhash", "timestamp": "1784340579", "to_ids": true, "type": "vhash", "uuid": "318954db-98f5-4bf1-bb09-24922f8cde64", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T15:41:00+00:00", "last_seen": "2026-04-16T15:41:00+00:00", "object_relation": "filename", "timestamp": "1784340579", "to_ids": true, "type": "filename", "uuid": "7193546e-cf38-423e-bb39-f73d712a0cb9", "value": "8olbs5.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346925", "uuid": "6db86683-2080-4d3b-a0ce-1bef4ed52023", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "md5", "timestamp": "1784346925", "to_ids": true, "type": "md5", "uuid": "d99f31b6-de96-47b9-8bbf-3cc043ffb34f", "value": "1005f616007900fcea0dde12a842466e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "sha1", "timestamp": "1784344469", "to_ids": true, "type": "sha1", "uuid": "6f1279e2-fea6-437d-b0bf-bf02b191d25d", "value": "6e73f7a17ea8e2d85349c37548c01ef9a6931b64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "sha256", "timestamp": "1784344469", "to_ids": true, "type": "sha256", "uuid": "caa6397b-f4ba-4919-8d68-c0b14d6525ff", "value": "901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "text", "timestamp": "1784340601", "to_ids": false, "type": "text", "uuid": "b0b67303-dcc4-4739-8168-2468cb7543c3", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Seen In The Wild: 2026-04-23T19:56:43+00:00\nFirst Submission: 2026-04-23T18:56:30+00:00\nLast Submission: 2026-04-24T11:54:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "ssdeep", "timestamp": "1784340601", "to_ids": true, "type": "ssdeep", "uuid": "4e832485-1518-45ae-a64e-e5f1bb66eb2a", "value": "24576:sr9mOB09gPT1vDpftigUmxB6WglGeYilN9r2w0wQgt8r9cXOrH/kzqG6WcRGunVt:srsOB0a1vDpUgPbMEilNIw0/3b/kzO9H" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340601", "to_ids": false, "type": "size-in-bytes", "uuid": "fd4e42a6-5227-4ebc-b91d-f84267aecfb7", "value": "2362056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "vhash", "timestamp": "1784340601", "to_ids": true, "type": "vhash", "uuid": "56c727f9-9610-4d7e-8b2e-066d2eab2dd9", "value": "026086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:56:30+00:00", "last_seen": "2026-04-24T11:54:19+00:00", "object_relation": "filename", "timestamp": "1784340601", "to_ids": true, "type": "filename", "uuid": "f5782f8a-d76d-4f66-9f92-35a70182a203", "value": "jv75azyeg.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346946", "uuid": "89a2695e-b026-4759-81cb-bcd99b8dc932", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "md5", "timestamp": "1784346946", "to_ids": true, "type": "md5", "uuid": "a07167e8-f76d-4cd0-aee2-39daad5f43a5", "value": "743494324f89277d5e2f3bb26c769cd6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "sha1", "timestamp": "1784344469", "to_ids": true, "type": "sha1", "uuid": "7c47cb71-5a91-4771-8b63-12b4ba1ba835", "value": "c7eee92a1687ca8a580a843a904bfa75e05ea8b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "sha256", "timestamp": "1784344470", "to_ids": true, "type": "sha256", "uuid": "442f4a96-6338-452a-b2a0-d6d2e7d753b0", "value": "914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "text", "timestamp": "1784340624", "to_ids": false, "type": "text", "uuid": "023683c0-06f4-44d6-8b8d-592a470af1c8", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/LummaStealer.GXM!MTB\nClamAV: None\nVT Total Detection: 53/74\nFirst Submission: 2026-04-16T06:41:57+00:00\nLast Submission: 2026-04-16T06:41:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "ssdeep", "timestamp": "1784340624", "to_ids": true, "type": "ssdeep", "uuid": "561a3ab8-accb-4626-9e94-15bd91691bbc", "value": "24576:IxRP3vszlVMwoP6Q/L1IethfteftlWdgUUdwqlOsHZEdXxQEkAdlMz8mcyHxNwul:qFEMjeqX7bdlXYvblibQW+sKLT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340624", "to_ids": false, "type": "size-in-bytes", "uuid": "a7618522-664d-43dc-b49a-f39970b028f9", "value": "1854080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "vhash", "timestamp": "1784340624", "to_ids": true, "type": "vhash", "uuid": "9554dc96-3a49-408b-b82d-7a6bdb7a8c75", "value": "016066656d1d15645az2c!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T06:41:57+00:00", "last_seen": "2026-04-16T06:41:57+00:00", "object_relation": "filename", "timestamp": "1784340624", "to_ids": true, "type": "filename", "uuid": "e2376c19-384f-461b-b379-94a3760a3027", "value": "45x2h.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346967", "uuid": "5c38a0b9-2279-4899-a670-d97d4a9b4b50", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "md5", "timestamp": "1784346967", "to_ids": true, "type": "md5", "uuid": "493c74bf-84e2-4ce0-8179-a875541bdedb", "value": "b7d7d440ef48aeb7ecfe79c28801b945", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "sha1", "timestamp": "1784344471", "to_ids": true, "type": "sha1", "uuid": "46936b3f-6822-45d0-be7c-308045daf5ab", "value": "528b3ddffdb22af3d18ebf484ed408634a009d0b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "sha256", "timestamp": "1784344471", "to_ids": true, "type": "sha256", "uuid": "c9c29b65-d664-40e4-8bfd-d8a9ac3474d3", "value": "94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f0978", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "text", "timestamp": "1784340646", "to_ids": false, "type": "text", "uuid": "43127aff-4e51-4b13-875a-1aae66cb34a1", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-04-23T15:16:18+00:00\nLast Submission: 2026-04-23T15:31:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "ssdeep", "timestamp": "1784340646", "to_ids": true, "type": "ssdeep", "uuid": "17fffda6-db47-48be-8995-ad4a97013f76", "value": "24576:GRMmM3o9gpWF7PnIYa3wOmg00V5R7nA0meITLcdtn+qG6WcRwUvTg:GRpM3hgbnIFwOmg00Vb7nA0cTLq8OSJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340646", "to_ids": false, "type": "size-in-bytes", "uuid": "e6499337-13c4-4751-8449-9ae017575696", "value": "1975496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "vhash", "timestamp": "1784340646", "to_ids": true, "type": "vhash", "uuid": "39f8612d-733f-4c75-b323-688496cb0bc6", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T15:16:18+00:00", "last_seen": "2026-04-23T15:31:20+00:00", "object_relation": "filename", "timestamp": "1784340646", "to_ids": true, "type": "filename", "uuid": "7c532d24-82b8-4a4b-b755-081f66f082a3", "value": "Bootstrapper.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784346988", "uuid": "cf1639e6-8236-42fb-b550-c90f05b633a3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "md5", "timestamp": "1784346988", "to_ids": true, "type": "md5", "uuid": "a59e8af8-6a20-4e70-ba16-f844d7b85ab0", "value": "889e5b8a51cf7d6dbeea4639a0cda463", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "sha1", "timestamp": "1784344472", "to_ids": true, "type": "sha1", "uuid": "5a60b82e-1ea4-437d-9618-4e2595f93258", "value": "68c7ea471df78f41deaf7f5a95ebd548ac32007f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "sha256", "timestamp": "1784344472", "to_ids": true, "type": "sha256", "uuid": "e8e07cf1-7007-44ea-9378-a2ef6a8e861d", "value": "9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab24751", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "text", "timestamp": "1784340667", "to_ids": false, "type": "text", "uuid": "6703e054-7ece-414a-b5dd-bb2b55cf3570", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-15T21:51:01+00:00\nFirst Submission: 2026-04-15T17:05:28+00:00\nLast Submission: 2026-04-15T17:05:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "ssdeep", "timestamp": "1784340667", "to_ids": true, "type": "ssdeep", "uuid": "0427c100-66c4-435d-9a18-7ad79630dd85", "value": "24576:ESTkEkKdh/sVxPxiE6WVS8YynastWa+/huDhyWurmuARwEHuYN5OxOkjS/pdNTB8:ESTk/khwxPkERNw2xNUJ1/R" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340667", "to_ids": false, "type": "size-in-bytes", "uuid": "955cc669-d92e-4d4e-a52a-8eb047f70e74", "value": "2454656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "vhash", "timestamp": "1784340667", "to_ids": true, "type": "vhash", "uuid": "19f5cd1a-5060-4d6e-b03f-98f3e6e818ee", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:05:28+00:00", "last_seen": "2026-04-15T17:05:28+00:00", "object_relation": "filename", "timestamp": "1784340667", "to_ids": true, "type": "filename", "uuid": "26df0504-e3a9-45a0-bbef-a028be56887c", "value": "b2kvdp7v8.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347009", "uuid": "cf892197-19e0-423a-bf70-105033b0a006", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "md5", "timestamp": "1784347009", "to_ids": true, "type": "md5", "uuid": "d9a33273-9967-436f-ac0c-7381279bf8ac", "value": "a3ac534d1d3755b8f9788ecb4cd5af75", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "sha1", "timestamp": "1784344473", "to_ids": true, "type": "sha1", "uuid": "40594fc7-e9ed-4a6e-8743-2c3e6aa70d53", "value": "b12990baa05d7e7abc5fcc548cd60d8f0b20b447", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "sha256", "timestamp": "1784344474", "to_ids": true, "type": "sha256", "uuid": "9ba46c2e-ea69-4fd7-aaff-2d2bd4ebd6c2", "value": "9b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "text", "timestamp": "1784340689", "to_ids": false, "type": "text", "uuid": "cb4f4db9-ead8-42f9-b9b6-1a037bab250b", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-16T01:06:52+00:00\nFirst Submission: 2026-04-15T20:52:19+00:00\nLast Submission: 2026-04-17T20:34:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "ssdeep", "timestamp": "1784340689", "to_ids": true, "type": "ssdeep", "uuid": "c4a3c683-84a2-45a3-acd5-428e7d59d0fe", "value": "49152:z4n3PIUuDcNiqcicV6hAXAqZVfCIEtNzy59:z4/q1TEAXAqwvO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340689", "to_ids": false, "type": "size-in-bytes", "uuid": "b6c4fea0-8cdf-48b3-8fc0-4e0a86af5e51", "value": "2464896" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "vhash", "timestamp": "1784340689", "to_ids": true, "type": "vhash", "uuid": "85da1cf1-85c8-47a0-9b72-930a4aaff082", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:52:19+00:00", "last_seen": "2026-04-17T20:34:38+00:00", "object_relation": "filename", "timestamp": "1784340689", "to_ids": true, "type": "filename", "uuid": "082abb6b-fe05-4359-93ac-ebe57824cb6b", "value": "Kiddions_menu.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347030", "uuid": "a8d9c403-227b-4fef-be9a-1de9ef606cea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "md5", "timestamp": "1784347030", "to_ids": true, "type": "md5", "uuid": "ad64a9aa-9d7b-4645-b9ee-91779f4f69b0", "value": "c62555a640d10dd780120fb708e87556", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "sha1", "timestamp": "1784344475", "to_ids": true, "type": "sha1", "uuid": "2980dda8-6079-4436-963b-3f63aa0e29dd", "value": "5744331fa1d4c87e1350e0498331d0f37e05ae74", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "sha256", "timestamp": "1784344475", "to_ids": true, "type": "sha256", "uuid": "a7c49980-95eb-477d-9d51-9865ce7fc015", "value": "a17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "text", "timestamp": "1784340710", "to_ids": false, "type": "text", "uuid": "ffaee5f6-09ad-425b-94d3-a8e08ff48a83", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Submission: 2026-04-16T02:17:32+00:00\nLast Submission: 2026-04-16T13:25:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "ssdeep", "timestamp": "1784340710", "to_ids": true, "type": "ssdeep", "uuid": "c861b9c0-a71e-4ebd-82f2-cda1754fe1eb", "value": "49152:VGxOUqNSZgswrYIyK22ZpcYg0RQYr09we:VeqPNrYIjZpcmQY4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340710", "to_ids": false, "type": "size-in-bytes", "uuid": "c65a6ed5-3ebd-456c-bf27-eea93d552a41", "value": "2229376" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "vhash", "timestamp": "1784340710", "to_ids": true, "type": "vhash", "uuid": "67d9c83b-c44c-4428-9061-4b3c24cb2431", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T02:17:32+00:00", "last_seen": "2026-04-16T13:25:53+00:00", "object_relation": "filename", "timestamp": "1784340710", "to_ids": true, "type": "filename", "uuid": "aa59757e-977f-4340-86a4-d3f60665b0e3", "value": "BootsrapplerFix.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347052", "uuid": "35c3a057-2dd9-477e-88b9-4d09254d6a6a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "md5", "timestamp": "1784347052", "to_ids": true, "type": "md5", "uuid": "778af9e2-1d4d-45c7-a999-c658c877ef7a", "value": "6bab4779d7a8c15d0f3ae2fc12ac70b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "sha1", "timestamp": "1784344476", "to_ids": true, "type": "sha1", "uuid": "5d6cd365-e4b4-45a9-93ce-01ec5d73643d", "value": "1e5488aed884d60d49e3be28615f312519aebeda", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "sha256", "timestamp": "1784344476", "to_ids": true, "type": "sha256", "uuid": "2405a7f1-c06e-4174-af05-292a32e61e7e", "value": "a4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "text", "timestamp": "1784340732", "to_ids": false, "type": "text", "uuid": "09adbb79-2d5f-4592-afe0-5eb5b8764802", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-15T20:49:29+00:00\nFirst Submission: 2026-04-15T19:49:13+00:00\nLast Submission: 2026-04-15T19:49:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "ssdeep", "timestamp": "1784340732", "to_ids": true, "type": "ssdeep", "uuid": "a2a272b2-bf82-4ff2-9257-cee88f2fb037", "value": "24576:ghmHpZr8kZ7YjYNRedTS4LXMwJ12NWYgsJuKBLtmiRyWFPrKFhele5n92ycRBO0:ghOTrV7YjSyTScJ12NHJXTmiR6rqB5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340732", "to_ids": false, "type": "size-in-bytes", "uuid": "68bc899e-91dc-441d-8b01-b3c9fc9f185b", "value": "2262656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "vhash", "timestamp": "1784340732", "to_ids": true, "type": "vhash", "uuid": "cf1a0370-90b7-4fae-b3c1-8bc6ad2776d6", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T19:49:13+00:00", "last_seen": "2026-04-15T19:49:13+00:00", "object_relation": "filename", "timestamp": "1784340732", "to_ids": true, "type": "filename", "uuid": "24881426-403b-429e-82bb-ec334e902dec", "value": "BootsarappperFixG.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347073", "uuid": "aec67316-0659-44df-8c46-8c48bf3f3e57", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "md5", "timestamp": "1784347073", "to_ids": true, "type": "md5", "uuid": "f8dc230d-1e97-4d7c-8624-25f8f2f06857", "value": "ae62de7ac965eec9e1e847de52fd23f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "sha1", "timestamp": "1784344477", "to_ids": true, "type": "sha1", "uuid": "67a99b96-9347-4c62-ad76-0b4be993ebc4", "value": "8fa67ba8bbd92dfce29fe3ad4c72f0bad90154a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "sha256", "timestamp": "1784344478", "to_ids": true, "type": "sha256", "uuid": "c1a08ded-d3cd-4224-8d3f-92a009c62ee9", "value": "a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "text", "timestamp": "1784340753", "to_ids": false, "type": "text", "uuid": "5e6173f1-b3e0-4dd2-8632-2291d1960407", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Seen In The Wild: 2026-04-16T20:03:53+00:00\nFirst Submission: 2026-04-16T19:03:44+00:00\nLast Submission: 2026-04-16T19:03:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "ssdeep", "timestamp": "1784340753", "to_ids": true, "type": "ssdeep", "uuid": "3150d63b-1aee-4ce6-a22a-cbc1c0141e30", "value": "49152:pUm00hSwNIB1e3eKzxmP3Q3Gb21skwRNb1j4h:pUMbEtKtmPgWbkskwRVWh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340753", "to_ids": false, "type": "size-in-bytes", "uuid": "c111576c-04e0-4243-9d63-d6de639bf32e", "value": "2447488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "vhash", "timestamp": "1784340753", "to_ids": true, "type": "vhash", "uuid": "b158233c-5ddd-4583-b23f-666b943adf26", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T19:03:44+00:00", "last_seen": "2026-04-16T19:03:44+00:00", "object_relation": "filename", "timestamp": "1784340753", "to_ids": true, "type": "filename", "uuid": "11096c9f-9719-475e-9c8d-fb35e5d39b72", "value": "v07cwl.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347094", "uuid": "b8073dbb-844e-4e9b-87e1-59f02a5337f8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "md5", "timestamp": "1784347094", "to_ids": true, "type": "md5", "uuid": "bfcf4bfe-76d0-4af3-a00a-6e11c739a487", "value": "0ea6e63015a208bb4671e148ec9bdde3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "sha1", "timestamp": "1784344479", "to_ids": true, "type": "sha1", "uuid": "77ca8649-63c6-44b2-84a5-78698937fb1f", "value": "e31bb579caa37aa100632b3636263575016c8fb1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "sha256", "timestamp": "1784344479", "to_ids": true, "type": "sha256", "uuid": "7a0991b6-6448-4d89-bcfd-9b0dc61ec437", "value": "aa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "text", "timestamp": "1784340775", "to_ids": false, "type": "text", "uuid": "852eb63e-1817-472d-a88e-b028c9d9dcd7", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-24T05:54:43+00:00\nFirst Submission: 2026-04-23T19:19:06+00:00\nLast Submission: 2026-04-26T09:39:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "ssdeep", "timestamp": "1784340775", "to_ids": true, "type": "ssdeep", "uuid": "b93a3b71-88ea-4909-8901-9923e47db913", "value": "24576:m5fosYYSMqy1dSwJXp2EhVbIlomGFWqv2U8Xsa:m5f3YYSCQwJXEETbCoFosa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340775", "to_ids": false, "type": "size-in-bytes", "uuid": "1d94b570-f74e-48fd-a2c4-679859c907ad", "value": "1917800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "vhash", "timestamp": "1784340775", "to_ids": true, "type": "vhash", "uuid": "b44e595f-2bcb-4dc4-ad03-d322a4b97d8a", "value": "1161376d1565551c051d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T19:19:06+00:00", "last_seen": "2026-04-26T09:39:30+00:00", "object_relation": "filename", "timestamp": "1784340775", "to_ids": true, "type": "filename", "uuid": "30295242-5252-42ff-b80e-d815f7f52ad6", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347115", "uuid": "a24b7190-a147-4452-a8bf-45212591a849", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "md5", "timestamp": "1784347115", "to_ids": true, "type": "md5", "uuid": "013bf9a5-e202-48ff-9c9a-f4ad5339b509", "value": "74f030db6a2ad9cb59ef6cebd0dbe0b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "sha1", "timestamp": "1784344480", "to_ids": true, "type": "sha1", "uuid": "6e29ed6f-79bd-43b1-b294-b3086f19f5ab", "value": "fecdcb3637d80932829d3a323b195c738757e382", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "sha256", "timestamp": "1784344480", "to_ids": true, "type": "sha256", "uuid": "a38df91f-57ff-42e1-bc08-06be71f14b3c", "value": "aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "text", "timestamp": "1784340797", "to_ids": false, "type": "text", "uuid": "053e5d4a-5967-478a-a7fa-78dd68f49380", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 50/74\nFirst Seen In The Wild: 2026-04-16T04:17:11+00:00\nFirst Submission: 2026-04-15T22:55:57+00:00\nLast Submission: 2026-04-16T16:49:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "ssdeep", "timestamp": "1784340797", "to_ids": true, "type": "ssdeep", "uuid": "8c3c40c6-d03d-43a2-bc79-5dd3874255fc", "value": "49152:vyUyiMNo9iqC8LegjQ5JGDelpGR43/y+D:vyIZhLtnDe3GW3/t" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340797", "to_ids": false, "type": "size-in-bytes", "uuid": "7f33c66b-bbd5-46c9-9c38-48da42a40a2c", "value": "2472576" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "vhash", "timestamp": "1784340797", "to_ids": true, "type": "vhash", "uuid": "cfb3078d-d007-46ba-bdff-d583241d3ceb", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T22:55:57+00:00", "last_seen": "2026-04-16T16:49:58+00:00", "object_relation": "filename", "timestamp": "1784340797", "to_ids": true, "type": "filename", "uuid": "02e2095c-abd3-4099-9b12-477f98d7b6ea", "value": "SoftWare.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347136", "uuid": "023672f4-b69c-40e6-b4fc-90afb4800140", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "md5", "timestamp": "1784347136", "to_ids": true, "type": "md5", "uuid": "275ff028-4683-4b83-a4a7-8917def61710", "value": "99e3b8a3b59122951b128a1032470c94", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "sha1", "timestamp": "1784344481", "to_ids": true, "type": "sha1", "uuid": "6c76a20b-f4ec-48b0-9797-f08a9ddcc2df", "value": "34c635265ff1ddeb55b80b6a084f7e9e5fa4a42c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "sha256", "timestamp": "1784344482", "to_ids": true, "type": "sha256", "uuid": "ef5c49ad-2015-4f84-8549-1ce9bd51fcff", "value": "b58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "text", "timestamp": "1784340819", "to_ids": false, "type": "text", "uuid": "29e58e7b-3490-4722-8a7b-388d7e895391", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2026-04-24T08:37:14+00:00\nFirst Submission: 2026-04-23T23:24:23+00:00\nLast Submission: 2026-04-28T13:56:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "ssdeep", "timestamp": "1784340819", "to_ids": true, "type": "ssdeep", "uuid": "3957eafe-d123-419e-8530-a224ab6a8c6d", "value": "49152:eaDdzXdamuLAWeep+o8uXmBXaELjclRTo:euExsaEL0To" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340819", "to_ids": false, "type": "size-in-bytes", "uuid": "c799a1e8-b47f-43c4-83b9-23379fe49b14", "value": "2404888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "vhash", "timestamp": "1784340819", "to_ids": true, "type": "vhash", "uuid": "bdc628f2-1ed6-4a22-89d0-ca01969c0964", "value": "1261376d1565551c051d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T23:24:23+00:00", "last_seen": "2026-04-28T13:56:47+00:00", "object_relation": "filename", "timestamp": "1784340819", "to_ids": true, "type": "filename", "uuid": "5b49d477-ec87-4fc1-b5c0-499191bb3cd2", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347157", "uuid": "1b22cb5b-3681-4e44-9b25-cdbad72e4707", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "md5", "timestamp": "1784347157", "to_ids": true, "type": "md5", "uuid": "814dadca-2a89-4a5e-803d-7174da88a2e9", "value": "8de888f138d3723191c7123cf1301cd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "sha1", "timestamp": "1784344483", "to_ids": true, "type": "sha1", "uuid": "8cddec10-2b1b-4209-81f1-6b55fb0554dd", "value": "99e75ecf99c8c692c3a28e3d712a86ab829cbea1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "sha256", "timestamp": "1784344483", "to_ids": true, "type": "sha256", "uuid": "1e0063e4-b345-4072-9ef4-8a010042a734", "value": "b927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "text", "timestamp": "1784340840", "to_ids": false, "type": "text", "uuid": "99dbca2d-895c-4926-ad98-cfa4722925d8", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-16T00:49:23+00:00\nFirst Submission: 2026-04-15T22:48:32+00:00\nLast Submission: 2026-04-15T22:48:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "ssdeep", "timestamp": "1784340840", "to_ids": true, "type": "ssdeep", "uuid": "857a98fa-b778-4266-b3b8-ab9d6d2dd532", "value": "49152:yw1dWREYT0zj9K2q8NQ+V1U+jXX2ZdvRs9:yZyY2NNQ+V1qZs9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340840", "to_ids": false, "type": "size-in-bytes", "uuid": "7ec84c2f-73f3-4335-9945-dccd0845ae49", "value": "2604112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "vhash", "timestamp": "1784340840", "to_ids": true, "type": "vhash", "uuid": "dd06f650-ab90-440d-8508-f2b1587b15a9", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T22:48:32+00:00", "last_seen": "2026-04-15T22:48:32+00:00", "object_relation": "filename", "timestamp": "1784340840", "to_ids": true, "type": "filename", "uuid": "9e0fdba0-5014-45de-a3cd-105aa2ec4c7d", "value": "yos9a6v.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347178", "uuid": "9d01ae7c-c313-414b-b3d7-bbdb7f5a59df", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "md5", "timestamp": "1784347178", "to_ids": true, "type": "md5", "uuid": "c059648e-d08b-4d99-a8e7-bc28ba105a1a", "value": "01aa01392e12a91adf08a6cc2615ed52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "sha1", "timestamp": "1784344484", "to_ids": true, "type": "sha1", "uuid": "2be8296f-d611-4868-abe6-a3fbadbb266a", "value": "a6f1cbd806f2250e96f0590a24c853c6375ee5bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "sha256", "timestamp": "1784344484", "to_ids": true, "type": "sha256", "uuid": "d88851da-792e-45cd-b05f-03c0c09d0628", "value": "bb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "text", "timestamp": "1784340862", "to_ids": false, "type": "text", "uuid": "897f44de-434a-4c2f-aa46-55720733a12c", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-16T13:00:18+00:00\nFirst Submission: 2026-04-16T11:59:59+00:00\nLast Submission: 2026-04-16T11:59:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "ssdeep", "timestamp": "1784340862", "to_ids": true, "type": "ssdeep", "uuid": "9c6a8319-9bbf-44d3-bb1a-8ebf0f422e7c", "value": "49152:bTLkE/vHAKzWICbkzubaTcZ6sFc2j7gPR62yt6C:bk25pIUjtsF0bC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340862", "to_ids": false, "type": "size-in-bytes", "uuid": "354e974b-3b91-4513-bcde-22d823e1add8", "value": "2474624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "vhash", "timestamp": "1784340862", "to_ids": true, "type": "vhash", "uuid": "e9a159d2-bef2-4daa-9b2e-d0076d3d1c15", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T11:59:59+00:00", "last_seen": "2026-04-16T11:59:59+00:00", "object_relation": "filename", "timestamp": "1784340862", "to_ids": true, "type": "filename", "uuid": "98cb4000-97b3-436e-89ba-3cf1be79e97a", "value": "3bsewlt.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347199", "uuid": "41778bbb-c680-4a57-bf95-173b0c861cbb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "md5", "timestamp": "1784347199", "to_ids": true, "type": "md5", "uuid": "2fd3af9d-9ba8-4b13-9cbc-2c145075bb98", "value": "bd91ac6617eb12b2cde1be93d14c7528", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "sha1", "timestamp": "1784344485", "to_ids": true, "type": "sha1", "uuid": "34db432c-b347-4c11-9e09-8c1e9583e0b9", "value": "8ea6577e64d46af66b39127a5f261a6e2e9c8310", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "sha256", "timestamp": "1784344485", "to_ids": true, "type": "sha256", "uuid": "8ac0b8e3-ffee-4599-9b85-36ab798cada8", "value": "bd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "text", "timestamp": "1784340884", "to_ids": false, "type": "text", "uuid": "50d8f012-b07b-46e7-bd34-996a6c5b479e", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-04-23T20:45:26+00:00\nLast Submission: 2026-04-24T01:35:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "ssdeep", "timestamp": "1784340884", "to_ids": true, "type": "ssdeep", "uuid": "110e28b3-580f-47d8-9917-219beab2c77b", "value": "49152:rBOTowuM3rodR7RqpZ5aiq925jDMGnRrOuY:rBN6tRXY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340884", "to_ids": false, "type": "size-in-bytes", "uuid": "407bbf86-2444-497a-a41b-ff279a841b2a", "value": "1970376" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "vhash", "timestamp": "1784340884", "to_ids": true, "type": "vhash", "uuid": "ee875618-a216-49d4-9763-c4ae0cefb8b8", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T20:45:26+00:00", "last_seen": "2026-04-24T01:35:10+00:00", "object_relation": "filename", "timestamp": "1784340884", "to_ids": true, "type": "filename", "uuid": "5938bef1-d994-45c9-b944-df872da74357", "value": "Bootstrapper.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347220", "uuid": "de798eb5-17e0-4022-b619-b1705a5d6775", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "md5", "timestamp": "1784347220", "to_ids": true, "type": "md5", "uuid": "fe8311ad-851b-4317-84e5-4213729d8a49", "value": "4a6a72df83e048914c49621279033d23", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "sha1", "timestamp": "1784344486", "to_ids": true, "type": "sha1", "uuid": "e216efd5-d8bd-4cb9-8cbf-7f54140e105b", "value": "692c727dd49e1ebf73a1ba503b7c2791b6456357", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "sha256", "timestamp": "1784344486", "to_ids": true, "type": "sha256", "uuid": "83c853cb-1e6c-4492-859b-07446db8262b", "value": "c25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "text", "timestamp": "1784340905", "to_ids": false, "type": "text", "uuid": "476a5027-1335-423a-9563-dbb763bb2d90", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 45/73\nFirst Seen In The Wild: 2026-04-24T09:49:17+00:00\nFirst Submission: 2026-04-23T18:15:32+00:00\nLast Submission: 2026-04-24T19:47:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "ssdeep", "timestamp": "1784340905", "to_ids": true, "type": "ssdeep", "uuid": "ea1b5b45-f278-46be-85e9-b8b236c59382", "value": "49152:GqxD59dciXZMScq21SH4+FOFA6Tyqxlacsm:Gy3bGsm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340905", "to_ids": false, "type": "size-in-bytes", "uuid": "d7052738-9024-4c47-80d5-605bc7d836b7", "value": "2385944" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "vhash", "timestamp": "1784340905", "to_ids": true, "type": "vhash", "uuid": "e9b471f5-410a-4a59-b94d-0b6a53a90055", "value": "1261376d1565551c055d1az3918&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:15:32+00:00", "last_seen": "2026-04-24T19:47:34+00:00", "object_relation": "filename", "timestamp": "1784340905", "to_ids": true, "type": "filename", "uuid": "ca289b75-be3b-44f5-835f-da3a77bb058b", "value": "s3a484a.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347241", "uuid": "36f5472e-4429-4ce7-9d3f-e81035c45afd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "md5", "timestamp": "1784347241", "to_ids": true, "type": "md5", "uuid": "f1511e3d-0e7e-4070-a96b-a652f5b5cad7", "value": "b5b3b91e46fc76260c13b5e08eb185fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "sha1", "timestamp": "1784344488", "to_ids": true, "type": "sha1", "uuid": "81d4b1e6-c73b-4277-a8ae-41953d43a325", "value": "6a9151b4e0baee130f55eb312699f0f3a5cc5c70", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "sha256", "timestamp": "1784344488", "to_ids": true, "type": "sha256", "uuid": "c9ffde1b-c1c8-4a62-bb89-7a781a721ab5", "value": "c328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "text", "timestamp": "1784340927", "to_ids": false, "type": "text", "uuid": "9f48e933-890b-4169-9978-8c1bd15c7e28", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar!AMTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-16T04:39:49+00:00\nFirst Submission: 2026-04-15T23:24:58+00:00\nLast Submission: 2026-04-15T23:24:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "ssdeep", "timestamp": "1784340927", "to_ids": true, "type": "ssdeep", "uuid": "2c852d53-0f9d-430f-ad1d-6846bbe1a7fc", "value": "24576:UlYxUgrTqdAi5FTsfiwWfUIys1zYjWBj+CFkJNTBele5y92XUs0yZ2:UlYSoTHi5Rrw6V1zALVkyu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340927", "to_ids": false, "type": "size-in-bytes", "uuid": "39a7244e-9cf6-46d7-bd0c-61c512eb4772", "value": "2455680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "vhash", "timestamp": "1784340927", "to_ids": true, "type": "vhash", "uuid": "7c2e584e-95ad-4acb-9e4c-71bf1f90f4f3", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T23:24:58+00:00", "last_seen": "2026-04-15T23:24:58+00:00", "object_relation": "filename", "timestamp": "1784340927", "to_ids": true, "type": "filename", "uuid": "a1c4c4a0-8487-445e-972f-1cd4d9f39c93", "value": "Installer.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347263", "uuid": "3c288f4f-e6e0-4d00-a5dc-e4949adf5c98", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "md5", "timestamp": "1784347263", "to_ids": true, "type": "md5", "uuid": "33b1b1ed-9f17-40cb-a63d-917fcfcf070a", "value": "4bd01edc939b9eb29036e4a810038a2a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "sha1", "timestamp": "1784344489", "to_ids": true, "type": "sha1", "uuid": "0d062a1c-868b-45c0-8f04-078b024e11b2", "value": "690de2467a685409079d919d4b55ac019ed2ee30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "sha256", "timestamp": "1784344489", "to_ids": true, "type": "sha256", "uuid": "f1e8d215-81d0-4e99-bfa1-c2a0786f7038", "value": "c39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "text", "timestamp": "1784340948", "to_ids": false, "type": "text", "uuid": "66197920-8cbf-4712-9fb5-d32fdc021a92", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Seen In The Wild: 2026-04-23T12:34:20+00:00\nFirst Submission: 2026-04-23T11:34:03+00:00\nLast Submission: 2026-04-23T11:34:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "ssdeep", "timestamp": "1784340948", "to_ids": true, "type": "ssdeep", "uuid": "e5e6589f-c489-4a9c-ac18-fa22651f54e6", "value": "24576:kskZpRrcVXW98ywSB/XUigyDj634OTBoziO7n1I3cqA2hZQAjmGFWPHx:kskRrb98uBrTbHPS3cB28SuR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340948", "to_ids": false, "type": "size-in-bytes", "uuid": "e7cbe3b9-bb63-4be0-b143-816e6f50d32f", "value": "5400542" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "vhash", "timestamp": "1784340948", "to_ids": true, "type": "vhash", "uuid": "2f551361-0eb2-4d4d-984f-4f553c18aab0", "value": "056086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T11:34:03+00:00", "last_seen": "2026-04-23T11:34:03+00:00", "object_relation": "filename", "timestamp": "1784340948", "to_ids": true, "type": "filename", "uuid": "93dfbbf5-e2bf-4a14-9622-aa05cbab6e66", "value": "Set.Up.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347284", "uuid": "07d110fb-aad7-4937-8f30-a8b514d14047", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "md5", "timestamp": "1784347284", "to_ids": true, "type": "md5", "uuid": "4ef97485-516c-4a83-92e8-6f0ed6b94f10", "value": "401a606c3f1e77f4a20775c82f9fd4e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "sha1", "timestamp": "1784344490", "to_ids": true, "type": "sha1", "uuid": "d1c0137e-7210-40b6-9098-7d527098004d", "value": "f173b4110a700982d9467f95e05e0c1cce6c7f6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "sha256", "timestamp": "1784344490", "to_ids": true, "type": "sha256", "uuid": "707381eb-be61-410a-8557-bf032266dc22", "value": "c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "text", "timestamp": "1784340970", "to_ids": false, "type": "text", "uuid": "d7298ce0-80cc-4427-b84d-1ede00c06fdc", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:03 AM 07/15/2026\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-16T05:05:22+00:00\nFirst Submission: 2026-04-15T13:24:57+00:00\nLast Submission: 2026-04-24T16:32:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "ssdeep", "timestamp": "1784340970", "to_ids": true, "type": "ssdeep", "uuid": "c5163cad-627e-4480-b80f-be474d6522a1", "value": "49152:Puta7slMgGCOy9IQu9Ib0xlhFZJQqZ2+t:PNR5y9dyhfHI+t" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340970", "to_ids": false, "type": "size-in-bytes", "uuid": "24269f1d-aef0-455f-a0d5-3c46e89133ca", "value": "2210616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "vhash", "timestamp": "1784340970", "to_ids": true, "type": "vhash", "uuid": "687dc4ca-3cac-4da3-8437-ae48ca010ac3", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:24:57+00:00", "last_seen": "2026-04-24T16:32:21+00:00", "object_relation": "filename", "timestamp": "1784340970", "to_ids": true, "type": "filename", "uuid": "fed6f06d-d200-4f7b-8098-ee15332aea1e", "value": "q4vteo8.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347305", "uuid": "e88a0d2f-d073-4dc0-b427-762faebdb038", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "md5", "timestamp": "1784347305", "to_ids": true, "type": "md5", "uuid": "a9bd7c85-f073-467b-8961-11706dfc2177", "value": "dd5c0503c08b5a97cc272fca1a37aded", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "sha1", "timestamp": "1784344492", "to_ids": true, "type": "sha1", "uuid": "3482280b-9ec6-42bb-8562-ba7115dba41a", "value": "c7fd6b2af95ead16bcd368172d26e4213a2f8300", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "sha256", "timestamp": "1784344492", "to_ids": true, "type": "sha256", "uuid": "e5806be9-cdda-4391-9da5-3a87b746f9c3", "value": "ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "text", "timestamp": "1784340991", "to_ids": false, "type": "text", "uuid": "b3b07b87-e278-4cc7-aa7e-c2ffc250909c", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-24T05:20:47+00:00\nFirst Submission: 2026-04-24T04:20:32+00:00\nLast Submission: 2026-04-27T02:53:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "ssdeep", "timestamp": "1784340991", "to_ids": true, "type": "ssdeep", "uuid": "ca8679db-3e2b-4b3e-8b15-cf73e8b5541b", "value": "49152:B2CYBBtl+KBWsiamhxEn6v2EQG41MSUOXbh:BcJEQJWSdN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784340991", "to_ids": false, "type": "size-in-bytes", "uuid": "317056f5-8476-4737-9150-7e9d1d361268", "value": "2541768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "vhash", "timestamp": "1784340991", "to_ids": true, "type": "vhash", "uuid": "535385cb-5b92-48a6-9008-22330e814a9a", "value": "026096656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T04:20:32+00:00", "last_seen": "2026-04-27T02:53:53+00:00", "object_relation": "filename", "timestamp": "1784340991", "to_ids": true, "type": "filename", "uuid": "d392497f-a325-43b1-8182-cf0a8defb912", "value": "1.exe_" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347326", "uuid": "f3a12eef-4c35-4c3f-83b4-242af4b8d1a3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "md5", "timestamp": "1784347326", "to_ids": true, "type": "md5", "uuid": "c478f734-c1b9-4df4-929b-87e7843e1862", "value": "69bb6cfd21d9bf8c0fdc172e6ff3d948", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "sha1", "timestamp": "1784344493", "to_ids": true, "type": "sha1", "uuid": "fb5761bf-1fc6-48d8-9500-cf10df8cc45f", "value": "f86600de5d88a4a38cd0ade3bfa2a7d64f4c68bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "sha256", "timestamp": "1784344493", "to_ids": true, "type": "sha256", "uuid": "ceed55b9-8a11-4000-8739-26b6fa652867", "value": "ce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "text", "timestamp": "1784341013", "to_ids": false, "type": "text", "uuid": "2e347df5-9b9c-4beb-921e-37050d63ea0c", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Submission: 2026-04-22T13:35:36+00:00\nLast Submission: 2026-04-23T20:08:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "ssdeep", "timestamp": "1784341013", "to_ids": true, "type": "ssdeep", "uuid": "742d7c8c-5e62-42f6-9c22-8215150bce80", "value": "49152:mtPdBp6MfJOqUwbXiTJhECwwYtDohgkOFdr:mKKtomr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341013", "to_ids": false, "type": "size-in-bytes", "uuid": "57e75ddb-ba66-4b97-a353-d261e390aee5", "value": "1970888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "vhash", "timestamp": "1784341013", "to_ids": true, "type": "vhash", "uuid": "acce37dc-e05e-48c5-a83a-72bcf6b7ea31", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T13:35:36+00:00", "last_seen": "2026-04-23T20:08:14+00:00", "object_relation": "filename", "timestamp": "1784341013", "to_ids": true, "type": "filename", "uuid": "72c83d43-5a0c-4f6b-aef7-46ad4762ef3a", "value": "Spyder_Source.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347348", "uuid": "16568e0a-32f7-43ea-bbae-3b3bbc2d1f67", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "md5", "timestamp": "1784347348", "to_ids": true, "type": "md5", "uuid": "d7d7f870-ded5-4baf-9cab-5efecd558b2c", "value": "5cb7f1f8e447cffec4526b6b25b70912", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "sha1", "timestamp": "1784344494", "to_ids": true, "type": "sha1", "uuid": "a6f3129d-0961-47ef-9f86-3e82daedf33b", "value": "b44371f803240eee3b5d78ff61df596bbf2d2f47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "sha256", "timestamp": "1784344494", "to_ids": true, "type": "sha256", "uuid": "dd4d9665-4f83-4339-9197-b79233d44be5", "value": "d18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "text", "timestamp": "1784341034", "to_ids": false, "type": "text", "uuid": "a479e73f-74f3-4f02-9aaf-96096898f7bc", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2026-04-23T13:29:14+00:00\nLast Submission: 2026-04-23T22:11:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "ssdeep", "timestamp": "1784341034", "to_ids": true, "type": "ssdeep", "uuid": "2aaa97a0-a714-4dc5-9e5e-f60e95a009f5", "value": "24576:wxOsdtW7/GyFduMQ8kWvAZj9slTmbkbRy2JkWeYnCYoW5IQiqG6WcRfAFXZ:wxntWxHut8tOBs6k9pJkEn1oWhiOOj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341034", "to_ids": false, "type": "size-in-bytes", "uuid": "fa121d7f-0b87-406b-97f1-e4e8ba99e93e", "value": "1974472" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "vhash", "timestamp": "1784341034", "to_ids": true, "type": "vhash", "uuid": "71e6c67b-9cd2-43a2-9342-1b83baa74c0c", "value": "016086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T13:29:14+00:00", "last_seen": "2026-04-23T22:11:52+00:00", "object_relation": "filename", "timestamp": "1784341034", "to_ids": true, "type": "filename", "uuid": "5db96f18-3835-4038-8245-c13f1ababe30", "value": "Setup.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347369", "uuid": "3831f93f-8323-42fd-99ce-97b96debab9b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "md5", "timestamp": "1784347369", "to_ids": true, "type": "md5", "uuid": "844142e7-6a90-4ba6-850d-99ed570686a3", "value": "0ea662204d79c383a2ce8613d19fb01d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "sha1", "timestamp": "1784344496", "to_ids": true, "type": "sha1", "uuid": "e99e5d06-5c03-4779-ac43-af2591fe31a6", "value": "bad2802906dc2add0e4207c8f02ad2d9f57e9804", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "sha256", "timestamp": "1784344496", "to_ids": true, "type": "sha256", "uuid": "fb371584-9a42-4f81-bb62-510f18dcd558", "value": "d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "text", "timestamp": "1784341055", "to_ids": false, "type": "text", "uuid": "d008d480-6d4e-4196-a6eb-0e0b078cf0c2", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-16T21:51:07+00:00\nFirst Submission: 2026-04-16T18:44:03+00:00\nLast Submission: 2026-04-16T18:44:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "ssdeep", "timestamp": "1784341055", "to_ids": true, "type": "ssdeep", "uuid": "0bd9c0b5-889f-45af-931f-cc61da2b41a6", "value": "49152:jG/MXfr0nhCvDQHLIvYe8RYstYFcVLwiZMDf6y:jwZIbQHLIgFdtYFcVLjCDf6y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341055", "to_ids": false, "type": "size-in-bytes", "uuid": "f9b2dd49-4c8b-477b-9b12-b614ad835fc3", "value": "2605296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "vhash", "timestamp": "1784341055", "to_ids": true, "type": "vhash", "uuid": "197cddd2-1e27-4ae3-8511-fe747e12703d", "value": "1261376d1565551c051d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:44:03+00:00", "last_seen": "2026-04-16T18:44:03+00:00", "object_relation": "filename", "timestamp": "1784341055", "to_ids": true, "type": "filename", "uuid": "1c80516d-33a0-4def-8f78-a130ceffc45a", "value": "x8iyu2aq6.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347390", "uuid": "1598dca2-c6b9-4051-b242-82b499ab73db", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "md5", "timestamp": "1784347390", "to_ids": true, "type": "md5", "uuid": "694344b6-2a2e-43d7-8d0d-9a1786201bdb", "value": "5df17528d75a8477b650a192343f2bf5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "sha1", "timestamp": "1784344497", "to_ids": true, "type": "sha1", "uuid": "2edfbefb-eacf-4acb-a19d-1418234528af", "value": "6bfe526ba399344c2514f3513c0b11acac0ff3b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "sha256", "timestamp": "1784344497", "to_ids": true, "type": "sha256", "uuid": "11f331e5-5a76-44a0-9b78-4000761204c9", "value": "d384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "text", "timestamp": "1784341077", "to_ids": false, "type": "text", "uuid": "90bfab40-d204-45ba-b099-01aff9ed1e86", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2026-04-16T01:25:39+00:00\nFirst Submission: 2026-04-15T20:05:12+00:00\nLast Submission: 2026-04-16T05:03:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "ssdeep", "timestamp": "1784341077", "to_ids": true, "type": "ssdeep", "uuid": "be2751f9-9962-4206-88d9-d86d54c26d68", "value": "24576:8yPZd3EzT0xbUfgiXQj6WqI6FfFRvdiIlEUxGRSgE3T5ls15P05KcTwpEJAMNTBj:8yhd0f0+4iIJ6FtgENEP0A4wpSU1a" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341077", "to_ids": false, "type": "size-in-bytes", "uuid": "2f917204-3b82-4be4-bc78-db012521f13f", "value": "2441856" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "vhash", "timestamp": "1784341077", "to_ids": true, "type": "vhash", "uuid": "f3ae3db1-ae28-44c9-96c0-36000e5c109d", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T20:05:12+00:00", "last_seen": "2026-04-16T05:03:28+00:00", "object_relation": "filename", "timestamp": "1784341077", "to_ids": true, "type": "filename", "uuid": "714ea27e-7934-4ac5-98e0-58e023063fd6", "value": "Installer.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347412", "uuid": "be23a3cd-c7a3-4079-aca5-d42d80972785", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "md5", "timestamp": "1784347412", "to_ids": true, "type": "md5", "uuid": "6c3cb9b9-76ea-4af5-9a79-f1699e38ca01", "value": "bca4ceec02e894620bfc41fb76be52ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "sha1", "timestamp": "1784344498", "to_ids": true, "type": "sha1", "uuid": "0a8abb6b-e410-4550-b58b-63b7b6dca0a2", "value": "351f577d287c293441a5a79b3da467cc63b5db20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "sha256", "timestamp": "1784344498", "to_ids": true, "type": "sha256", "uuid": "f0ed28a0-e872-48bb-9fda-f1dc6a5e83c4", "value": "d78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "text", "timestamp": "1784341099", "to_ids": false, "type": "text", "uuid": "66ef1303-5527-443e-be96-a6396c7499f9", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/LummaStealer.GXM!MTB\nClamAV: None\nVT Total Detection: 50/74\nFirst Submission: 2026-04-17T01:09:05+00:00\nLast Submission: 2026-04-17T02:02:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "ssdeep", "timestamp": "1784341099", "to_ids": true, "type": "ssdeep", "uuid": "ab2dcecd-a8ff-4fa6-b4de-8c9ea7201a9e", "value": "24576:8W+kq3N6+CKQ/Lx91yXBrQKfHEc5YbJwGZSco9jKwblo3A1uQhYRmtEypBb3gQjZ:8RRBRrQo5uQEmtEypBbQQN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341099", "to_ids": false, "type": "size-in-bytes", "uuid": "ffda4cb0-cfc1-472c-869e-46e8690114c0", "value": "1799808" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "vhash", "timestamp": "1784341099", "to_ids": true, "type": "vhash", "uuid": "1635ea5c-b493-4160-afdc-f1b519f4b4f6", "value": "016066656d1d15645az2c!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T01:09:05+00:00", "last_seen": "2026-04-17T02:02:17+00:00", "object_relation": "filename", "timestamp": "1784341099", "to_ids": true, "type": "filename", "uuid": "ff44fd62-6de8-4445-bd0d-d22039d59ef8", "value": "r9kj7zi.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347433", "uuid": "c55487b6-b2aa-4fbc-8677-568591d123cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "md5", "timestamp": "1784347433", "to_ids": true, "type": "md5", "uuid": "881d2073-cdd7-4728-a654-52147fc37158", "value": "34c80f0febc50bc01d56a0d726a2e557", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "sha1", "timestamp": "1784344499", "to_ids": true, "type": "sha1", "uuid": "03f0af76-2760-49d9-8f1e-ac73f64a52de", "value": "bf0237ce3f83694ad57304513cca49c261c1ed91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "sha256", "timestamp": "1784344499", "to_ids": true, "type": "sha256", "uuid": "7ac15ca6-2f48-4f0e-b040-84d7ba4e1765", "value": "d7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "text", "timestamp": "1784341121", "to_ids": false, "type": "text", "uuid": "4dafff84-aa30-49b6-9d5b-e6b40fc57a31", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-15T18:15:54+00:00\nFirst Submission: 2026-04-15T13:01:15+00:00\nLast Submission: 2026-04-15T13:01:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "ssdeep", "timestamp": "1784341121", "to_ids": true, "type": "ssdeep", "uuid": "a1057bf7-72ea-44f0-808e-85d5d25c2541", "value": "49152:GSHMM1QibVt0fxiXNqGgIux+mfZV6d4/T:GU/b0c+Iux+mfD/T" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341121", "to_ids": false, "type": "size-in-bytes", "uuid": "6a1912a1-e5f8-4fa2-8eb9-daba088f6838", "value": "2596336" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "vhash", "timestamp": "1784341121", "to_ids": true, "type": "vhash", "uuid": "9b2c3ec4-76c9-4b0a-94ef-3909cf761506", "value": "1261376d1565551c051d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T13:01:15+00:00", "last_seen": "2026-04-15T13:01:15+00:00", "object_relation": "filename", "timestamp": "1784341121", "to_ids": true, "type": "filename", "uuid": "d973cd2a-f8b7-401b-a8ee-1581fd4ef656", "value": "mpclient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347454", "uuid": "f0771495-c03a-45e4-98aa-014236c6288f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "md5", "timestamp": "1784347454", "to_ids": true, "type": "md5", "uuid": "46c31256-e841-4080-af0e-ab1266d21146", "value": "2561e23f5c3353362cc2ba57abe8bbc1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "sha1", "timestamp": "1784344500", "to_ids": true, "type": "sha1", "uuid": "f5ea337f-6bde-4ce3-a116-daaf43fe1121", "value": "06d71b3d6b487be16dfe21a44ce10d8430b377c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "sha256", "timestamp": "1784344500", "to_ids": true, "type": "sha256", "uuid": "3f7ce792-1dd7-472f-87bb-1605fe27f007", "value": "d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "text", "timestamp": "1784341143", "to_ids": false, "type": "text", "uuid": "6c2bf62b-5239-44bc-af67-aab9fd1d8a6d", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nSigning date: 08:06 AM 07/15/2026\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 38/74\nFirst Seen In The Wild: 2026-04-16T16:25:39+00:00\nFirst Submission: 2026-04-16T10:34:51+00:00\nLast Submission: 2026-04-16T10:34:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "ssdeep", "timestamp": "1784341143", "to_ids": true, "type": "ssdeep", "uuid": "0a3f200a-e889-41e0-af65-0e42acf549a9", "value": "49152:XJjx/rvM+9G1pMOlj4gtRjHuHqAQU7Pmir2K:XxpX9M+OlkgnuQU7+i/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341143", "to_ids": false, "type": "size-in-bytes", "uuid": "c0446156-6f59-4fa4-9663-faf76d783a49", "value": "2232448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "vhash", "timestamp": "1784341143", "to_ids": true, "type": "vhash", "uuid": "445b80c3-8c32-4a07-87bc-12d2d93ce94d", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T10:34:51+00:00", "last_seen": "2026-04-16T10:34:51+00:00", "object_relation": "filename", "timestamp": "1784341143", "to_ids": true, "type": "filename", "uuid": "012a8440-0179-4edb-95ab-470c08c24344", "value": "4oj6bp7q.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347475", "uuid": "ca651452-3c16-43d8-bb0f-fbf2153697b8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "md5", "timestamp": "1784347475", "to_ids": true, "type": "md5", "uuid": "80f305d5-8516-4a35-ab44-485009cb9412", "value": "fc62992bea0b4d247af6425801e61a85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "sha1", "timestamp": "1784344502", "to_ids": true, "type": "sha1", "uuid": "96504d05-ff2a-4ba3-a070-ab3a69891c14", "value": "89384665e093678ae2ab8f657d2ccd64267e1bed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "sha256", "timestamp": "1784344502", "to_ids": true, "type": "sha256", "uuid": "2e2383b2-642f-4065-b482-a0e242d33316", "value": "d8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "text", "timestamp": "1784341165", "to_ids": false, "type": "text", "uuid": "ca1a6acf-4528-47ba-8a3d-a4d2c2894d68", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-04-23T15:23:55+00:00\nFirst Submission: 2026-04-23T14:23:23+00:00\nLast Submission: 2026-05-07T18:01:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "ssdeep", "timestamp": "1784341165", "to_ids": true, "type": "ssdeep", "uuid": "d4a7ebb7-9d22-4058-bd2f-07d43e1fdc53", "value": "49152:RBKISwyJZyRfF5Mm9iPnpL1wn3Pe+BPR6UV58:R814FPR+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341165", "to_ids": false, "type": "size-in-bytes", "uuid": "1c440552-5d28-41dc-b6d8-7eb4599130fa", "value": "2619080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "vhash", "timestamp": "1784341165", "to_ids": true, "type": "vhash", "uuid": "3ca1d915-b56d-427f-80c5-cddd580d61fd", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T14:23:23+00:00", "last_seen": "2026-05-07T18:01:31+00:00", "object_relation": "filename", "timestamp": "1784341165", "to_ids": true, "type": "filename", "uuid": "ad43eca6-4895-4b0d-9ae6-f16b6ad5deb2", "value": "9pbfs.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347496", "uuid": "5c297528-91ee-4832-af44-42669860a5b9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "md5", "timestamp": "1784347496", "to_ids": true, "type": "md5", "uuid": "d796c8e1-ebeb-4d58-9571-016c095f4ed8", "value": "e28f7e54b2f266508030d4c2ad9027fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "sha1", "timestamp": "1784344503", "to_ids": true, "type": "sha1", "uuid": "eaa1a43e-327e-47c5-8479-af08eec6d88c", "value": "ad350514230b215b194b1e07de6f4d6585611b58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "sha256", "timestamp": "1784344504", "to_ids": true, "type": "sha256", "uuid": "2ca59362-6e46-46d6-ac9d-7a0d0ea635de", "value": "d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "text", "timestamp": "1784341186", "to_ids": false, "type": "text", "uuid": "7c507da8-25b7-4810-bef6-81a79d7e6ea6", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2026-04-16T18:30:47+00:00\nFirst Submission: 2026-04-16T14:01:17+00:00\nLast Submission: 2026-04-16T14:01:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "ssdeep", "timestamp": "1784341186", "to_ids": true, "type": "ssdeep", "uuid": "662b58eb-7731-47e6-af49-822440354b8a", "value": "24576:6UGNbcY95GVquwnMLTRuc7jlCqmxkclpaALE8OLnS0Der+PuMjogu88BTBele5y+:6UGBr9kVSnMnRvj9m5aH2iXyyC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341186", "to_ids": false, "type": "size-in-bytes", "uuid": "378c3a52-254f-42fe-ac8c-fc8e79126559", "value": "2453632" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "vhash", "timestamp": "1784341186", "to_ids": true, "type": "vhash", "uuid": "e4e0d579-ad63-4fc3-980b-0e5a229724fa", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T14:01:17+00:00", "last_seen": "2026-04-16T14:01:17+00:00", "object_relation": "filename", "timestamp": "1784341186", "to_ids": true, "type": "filename", "uuid": "060dbce0-1e1d-4c6a-83a1-47258df9bd1a", "value": "k1mc5.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347517", "uuid": "7d45c449-dad4-401f-ba08-935adecf44cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "md5", "timestamp": "1784347517", "to_ids": true, "type": "md5", "uuid": "2e6a65f3-5997-436a-a566-ab954b859628", "value": "1ed98954557a9a6c04dac70bbb3cb401", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "sha1", "timestamp": "1784344505", "to_ids": true, "type": "sha1", "uuid": "980c6bfb-d95a-4fa5-b834-861f4b6a7d72", "value": "c42c7a234bd265250d7ab40739ad3c3649f9b65e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "sha256", "timestamp": "1784344505", "to_ids": true, "type": "sha256", "uuid": "aa3363fd-94b6-4666-a447-527b7c8cde3d", "value": "db2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "text", "timestamp": "1784341207", "to_ids": false, "type": "text", "uuid": "85d9fdb8-db8c-4362-b363-448bc44e93d6", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-16T21:46:34+00:00\nFirst Submission: 2026-04-16T18:06:45+00:00\nLast Submission: 2026-04-16T19:07:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "ssdeep", "timestamp": "1784341207", "to_ids": true, "type": "ssdeep", "uuid": "ca88f9d4-e972-4e47-a38f-03bd43779ee9", "value": "49152:jDhmWJX0zl6Rv5MYF4yFFonh36g/ESBaty:jv65EMYF4oynh36g/gty" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341207", "to_ids": false, "type": "size-in-bytes", "uuid": "1f53a678-d701-452a-afb1-952b88fef3a2", "value": "2584456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "vhash", "timestamp": "1784341207", "to_ids": true, "type": "vhash", "uuid": "4acd658a-1da4-411e-a0e7-9197ae4bafc4", "value": "1261376d1565551c055d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:06:45+00:00", "last_seen": "2026-04-16T19:07:26+00:00", "object_relation": "filename", "timestamp": "1784341207", "to_ids": true, "type": "filename", "uuid": "bf6a0e9d-e3b0-4dc8-b9ae-5c0490c6bb98", "value": "5jryy46u4.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347539", "uuid": "ef1b9d90-80b1-4389-bfed-d75f11626c23", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "md5", "timestamp": "1784347539", "to_ids": true, "type": "md5", "uuid": "34440db8-66b0-4d90-9b69-f64a094781c6", "value": "64cdcf9cf943978aa20343af8a579a8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "sha1", "timestamp": "1784344506", "to_ids": true, "type": "sha1", "uuid": "3d95e503-281b-40cf-a389-8357bad6c01d", "value": "73095ac3f56739133308ef0b60223c27b15cb712", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "sha256", "timestamp": "1784344506", "to_ids": true, "type": "sha256", "uuid": "25cf9fd4-d604-44d8-ba7b-df52ee2ef3cc", "value": "dccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "text", "timestamp": "1784341229", "to_ids": false, "type": "text", "uuid": "e5432209-c608-46c9-b231-ac8411613734", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-23T08:14:09+00:00\nFirst Submission: 2026-04-23T07:14:04+00:00\nLast Submission: 2026-04-23T18:22:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "ssdeep", "timestamp": "1784341229", "to_ids": true, "type": "ssdeep", "uuid": "99b470d5-ffa5-4c32-8335-90f1eb92f110", "value": "49152:+YHBknSTdnwFGrZ2CWlt+rIxOPztzheIOV8X:+L1xObtzhe7w" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341229", "to_ids": false, "type": "size-in-bytes", "uuid": "cee3547f-9527-4b67-aec1-26ddfc2254da", "value": "7613136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "vhash", "timestamp": "1784341229", "to_ids": true, "type": "vhash", "uuid": "a952f861-edd9-4bfb-bd04-06332b033715", "value": "076086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T07:14:04+00:00", "last_seen": "2026-04-23T18:22:32+00:00", "object_relation": "filename", "timestamp": "1784341229", "to_ids": true, "type": "filename", "uuid": "8215cc17-1c86-4bd6-a412-7b621ab8e6a4", "value": "oyllzck.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347560", "uuid": "e494ead1-fc9a-4e8a-a1cd-220323ac2c6b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "md5", "timestamp": "1784347560", "to_ids": true, "type": "md5", "uuid": "01b95fd8-6acc-473c-9745-15f1f5505229", "value": "9e6bbd6ecddb74b590117f4df3b4506d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "sha1", "timestamp": "1784344507", "to_ids": true, "type": "sha1", "uuid": "48e3d2ba-1bfc-4fef-b41a-358e9a716a3c", "value": "d1ef4e70fdabeab340eb2c0f85a436e0646cd6b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "sha256", "timestamp": "1784344507", "to_ids": true, "type": "sha256", "uuid": "85309bd4-d9fd-4800-9089-3da22703f469", "value": "e5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "text", "timestamp": "1784341250", "to_ids": false, "type": "text", "uuid": "abb56b4a-7173-41ab-983c-81df1072ae55", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-24T00:18:20+00:00\nFirst Submission: 2026-04-23T20:27:55+00:00\nLast Submission: 2026-04-24T03:29:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "ssdeep", "timestamp": "1784341250", "to_ids": true, "type": "ssdeep", "uuid": "26419f65-156b-4d7f-955d-3edcf39e405f", "value": "49152:6vz9PfolYph+2VvMNoHa/6xT/208/4UUxioB5d:6KQbl8g7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341250", "to_ids": false, "type": "size-in-bytes", "uuid": "cd95b9c1-3498-4a5a-91aa-9af105157dfb", "value": "2625224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "vhash", "timestamp": "1784341250", "to_ids": true, "type": "vhash", "uuid": "db439551-5f39-47c2-8756-5dd8bb6e0b08", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T20:27:55+00:00", "last_seen": "2026-04-24T03:29:49+00:00", "object_relation": "filename", "timestamp": "1784341250", "to_ids": true, "type": "filename", "uuid": "1eb2f3e0-7aa1-44bc-980d-a4a2c6101d24", "value": "quantium.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347581", "uuid": "00522774-6e91-499c-9b8f-ab31220b522d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "md5", "timestamp": "1784347581", "to_ids": true, "type": "md5", "uuid": "7b1bdf3e-9710-4e79-b866-fce86acd6239", "value": "bf0fb3bea02929fae553d7f958dcf4cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "sha1", "timestamp": "1784344508", "to_ids": true, "type": "sha1", "uuid": "4c547707-70d2-445c-835e-24bb7eed7b5d", "value": "f6c7f321ce929d88377f3fa5afac801394e7a259", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "sha256", "timestamp": "1784344509", "to_ids": true, "type": "sha256", "uuid": "613d3bbf-0bf3-4ada-9383-c4a87eb62795", "value": "e88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "text", "timestamp": "1784341272", "to_ids": false, "type": "text", "uuid": "0dbe372d-61f0-41f4-89bc-2a8ef58be75e", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Vidar.GN!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-04-23T16:01:11+00:00\nFirst Submission: 2026-04-23T15:01:02+00:00\nLast Submission: 2026-04-23T18:56:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "ssdeep", "timestamp": "1784341272", "to_ids": true, "type": "ssdeep", "uuid": "78254c31-28d7-488b-92d5-6d1a24d75c64", "value": "49152:+X493lgN/VtJ+JdcbCj5i7G3tN+oScm5W:+LubSE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341272", "to_ids": false, "type": "size-in-bytes", "uuid": "0aeffa23-d60a-4994-b943-d3b4f51d834b", "value": "3673288" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "vhash", "timestamp": "1784341272", "to_ids": true, "type": "vhash", "uuid": "1026974f-b920-436a-9b2f-1d3e52352cd4", "value": "036086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T15:01:02+00:00", "last_seen": "2026-04-23T18:56:56+00:00", "object_relation": "filename", "timestamp": "1784341272", "to_ids": true, "type": "filename", "uuid": "e2971213-657f-44ac-9280-9583e486241d", "value": "CapCut Pro.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347602", "uuid": "ef59bbcc-2f9e-4360-bdb0-38086fb6b776", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "md5", "timestamp": "1784347602", "to_ids": true, "type": "md5", "uuid": "a1c5b343-8995-4dca-a505-827aa0e20033", "value": "cebf63436f2f3f2919d1a341d3f62207", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "sha1", "timestamp": "1784344509", "to_ids": true, "type": "sha1", "uuid": "98548594-907c-4ae5-a1cf-bde7f43f6e9e", "value": "c055f651e8d889b63261e874d9196bdcf105e2de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "sha256", "timestamp": "1784344509", "to_ids": true, "type": "sha256", "uuid": "0f17632b-b7e3-4b0e-b382-e73d94bb26d9", "value": "e9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "text", "timestamp": "1784341293", "to_ids": false, "type": "text", "uuid": "52f883f6-4692-42b5-8760-ac0a40565d90", "value": "Type Description: Win32 DLL\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/MuckLoader.MU!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-04-16T03:14:44+00:00\nFirst Submission: 2026-04-15T23:48:32+00:00\nLast Submission: 2026-04-15T23:48:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "ssdeep", "timestamp": "1784341293", "to_ids": true, "type": "ssdeep", "uuid": "af0b0b28-e0c2-4e88-999d-92669e224530", "value": "49152:YB1q8Fn2M/dhbtFWc4Ua93hPborvAZuZUz24s+:YyurbtFWc4UCxPKqs+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341293", "to_ids": false, "type": "size-in-bytes", "uuid": "47f73234-ba58-4cb0-861f-76839109390a", "value": "2594408" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "vhash", "timestamp": "1784341293", "to_ids": true, "type": "vhash", "uuid": "78c6362e-c4a9-48f6-b1c0-e050fb1ff214", "value": "1261376d1565551c051d1az3917&zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T23:48:32+00:00", "last_seen": "2026-04-15T23:48:32+00:00", "object_relation": "filename", "timestamp": "1784341293", "to_ids": true, "type": "filename", "uuid": "0f81590b-0e0b-467a-9f61-950a35455236", "value": "h37mbq26.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347624", "uuid": "f07b4473-83f1-4e28-92a8-79e8b1faf69a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "md5", "timestamp": "1784347624", "to_ids": true, "type": "md5", "uuid": "9039f698-4b36-4e0d-89a6-af83dca51f64", "value": "ff8999dba524ad59889db21f86b9e986", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "sha1", "timestamp": "1784344510", "to_ids": true, "type": "sha1", "uuid": "c8c068a0-fff0-4385-a3f5-9857a7712363", "value": "adb6cb37bfdde6340c5db8b48cdeda94d7f67c95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "sha256", "timestamp": "1784344510", "to_ids": true, "type": "sha256", "uuid": "288dd22d-551c-46b7-bcaf-dab96fe0ddfe", "value": "f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "text", "timestamp": "1784341315", "to_ids": false, "type": "text", "uuid": "66820d7e-647a-40b4-ac8e-fc0aae9293fc", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2026-04-15T15:52:47+00:00\nLast Submission: 2026-04-15T15:52:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "ssdeep", "timestamp": "1784341315", "to_ids": true, "type": "ssdeep", "uuid": "b4648ba9-efe3-4a80-8a8b-11ec8a2916fe", "value": "24576:VU+bepF5ge7MYqB1TGLKSZ+l3K8LN4p5OySkVyhAq5FNInt2/2xBTBele5y92XUH:VU+bsF+eRqB1G+9b2g1h95FcYuwykF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341315", "to_ids": false, "type": "size-in-bytes", "uuid": "e48fe7e2-0050-472c-a633-7068e7d24d32", "value": "2474112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "vhash", "timestamp": "1784341315", "to_ids": true, "type": "vhash", "uuid": "4cab3794-8f0d-4d2a-b38e-aad3dcc395b9", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T15:52:47+00:00", "last_seen": "2026-04-15T15:52:47+00:00", "object_relation": "filename", "timestamp": "1784341315", "to_ids": true, "type": "filename", "uuid": "5146623a-c6ab-4a00-9d49-4321b200f661", "value": "MicrosoftUpdate.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347645", "uuid": "72b675e9-cb25-49d4-92ad-9d8783b84fbe", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "md5", "timestamp": "1784347645", "to_ids": true, "type": "md5", "uuid": "5cfa1457-109b-4fcd-8724-40286d6e0462", "value": "0d3423fe305da664392469515e2f1562", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "sha1", "timestamp": "1784344511", "to_ids": true, "type": "sha1", "uuid": "92dc457f-f9f0-4381-9379-f5cfeb611bdb", "value": "3fb910116d319be1118f69f6fa6e398a89790c20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "sha256", "timestamp": "1784344511", "to_ids": true, "type": "sha256", "uuid": "8397f8f2-7bc1-4f98-9345-3a3b3ecae7e2", "value": "f13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "text", "timestamp": "1784341336", "to_ids": false, "type": "text", "uuid": "4890bb35-59df-492b-9864-6b9979606dbc", "value": "Type Description: Win32 EXE\nVerified: A certificate chain could not be built to a trusted root authority.\nMicrosoft: Trojan:Win64/RemusStealer.PAA!MTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-04-23T19:54:09+00:00\nFirst Submission: 2026-04-23T18:53:54+00:00\nLast Submission: 2026-04-27T19:18:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "ssdeep", "timestamp": "1784341336", "to_ids": true, "type": "ssdeep", "uuid": "40b0b2df-c700-46bc-a973-4e24cc3459ec", "value": "24576:GDwkARU7EWofLUCPeFM4z7sBMtOEfS1+2xa2EWdEcAtGEDXTm+NQ:GcJU7cUqgvOMtOEfpcaHUEcA5iL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341336", "to_ids": false, "type": "size-in-bytes", "uuid": "c3cbbc49-68e6-44a4-b8ec-ec82e0c6d08c", "value": "2619080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "vhash", "timestamp": "1784341336", "to_ids": true, "type": "vhash", "uuid": "1016732d-d5f2-4ea2-bf40-3a4397b74f13", "value": "026086656d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:53:54+00:00", "last_seen": "2026-04-27T19:18:36+00:00", "object_relation": "filename", "timestamp": "1784341336", "to_ids": true, "type": "filename", "uuid": "71aa689e-a5d8-4c8d-a3be-84d9e73ccdb2", "value": "Menu.exe" } ] } ] } }