{ "Event": { "analysis": "1", "date": "2026-06-04", "extends_uuid": "", "info": "[Threat Intel] VerdantBamboo: Just Another BRICKSTORM in the Firewall", "protected": false, "publish_timestamp": "1781219606", "published": true, "threat_level_id": "1", "timestamp": "1781219605", "uuid": "b98c3a16-ac1c-4229-a5c1-703341f6336b", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0f1804", "local": false, "name": "misp-galaxy:producer=\"Volexity\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#95f9b9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Sudo and Sudo Caching - T1548.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1087.001\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#a4da83", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"", "relationship_type": "" }, { "colour": "#aad818", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#fe1ef0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#6d779a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"", "relationship_type": "" }, { "colour": "#57997c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"", "relationship_type": "" }, { "colour": "#08b028", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": "" }, { "colour": "#7d37d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#c295b4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UTA0178\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"WARP PANDA\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"BRICKSTORM\"", "relationship_type": "" }, { "colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780916409", "to_ids": false, "type": "link", "uuid": "44ab0607-d67e-4ad9-9d64-b4fc1ae5359e", "value": "https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780916409", "to_ids": false, "type": "text", "uuid": "b73357dd-e6a4-4abe-888e-e961f3c3a5b3", "value": "Chinese threat actor VerdantBamboo compromised a victim organization and its Managed Services Provider over an 18-month period, deploying malware on network edge devices lacking EDR coverage. The initial breach involved an Egnyte Storage Sync system, where attackers exploited a sudo misconfiguration for privilege escalation and installed BRICKSTORM backdoor and AGENTPSD fallback implant. Investigation revealed the MSP's pfSense firewall was also compromised with a FreeBSD variant of BRICKSTORM. After remediation, VerdantBamboo regained access through stolen firewall credentials, enabling custom VPN access and deploying PLENET backdoor on a Synology NAS. The threat actor leveraged compromised systems as proxies to access Microsoft 365 environments while evading security controls. VerdantBamboo demonstrated operational discipline by targeting appliances without EDR capabilities and using sophisticated malware including PLENET, compiled with .NET Native AOT to hinder analysis." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780916409", "to_ids": false, "type": "text", "uuid": "43ccaae2-3431-43b5-bb5a-fb9e89169c7f", "value": "Name: VerdantBamboo: Just Another BRICKSTORM in the Firewall\nAuthor: AlienVault\nAdversary: VerdantBamboo\nTags: [\"verdantbamboo\", \"brickstorm\"]\nTgtd countries: []\nMlwr families: [\"BRICKSTORM\", \"PLENET\", \"AGENTPSD\"]\nAttack_ids: [\"T1133\", \"T1548.003\", \"T1087.001\", \"T1543.003\", \"T1053.003\", \"T1021.004\", \"T1190\", \"T1505.003\", \"T1059.004\", \"T1562.001\", \"T1078\", \"T1068\", \"T1102.002\", \"T1573.002\", \"T1059.006\", \"T1070.004\", \"T1027.002\", \"T1071.001\", \"T1090.001\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1781212606", "to_ids": false, "type": "threat-actor", "uuid": "8963d50c-9b8d-4619-9e0d-7bec8feacae6", "value": "VerdantBamboo", "Tag": [ { "colour": "#0f1804", "local": false, "name": "misp-galaxy:producer=\"Volexity\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UTA0178\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"WARP PANDA\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1781218518", "to_ids": true, "type": "ip-dst", "uuid": "e41f5832-2bf8-4790-96c2-fd5bd4c2e238", "value": "192.3.30.159", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215116", "to_ids": true, "type": "sha256", "uuid": "187e628c-3aa1-46e5-9b97-5f4a7ac9a82a", "value": "42692bd13333623e9085d0c1326574a3391efcbf18158bb04972103c9ee4a3b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215117", "to_ids": true, "type": "sha256", "uuid": "41198e2d-f8ab-4328-aa48-da1e43c009d5", "value": "b42159d68ba58d7857c091b5acc59e30e50a854b15f7ce04b61ff6c11cdf0156", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=IR ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1781218539", "to_ids": true, "type": "ip-dst", "uuid": "01fba118-9cf6-4380-9cdd-367078c4729e", "value": "5.223.58.4", "Tag": [ { "colour": "#eb987c", "local": false, "name": "asn:asn=\"215859\"", "relationship_type": "" }, { "colour": "#bbf1ed", "local": false, "name": "asn:as-owner=\"HETZNER-CLOUD4-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218560", "to_ids": true, "type": "hostname", "uuid": "f52b84c1-fe76-4bf1-82e4-2ce7be234628", "value": "service.systemsvcs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218581", "to_ids": true, "type": "domain", "uuid": "b9ad68ea-fae6-4db6-ae30-a6cdfde064a6", "value": "winfoacacorp.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218603", "to_ids": true, "type": "domain", "uuid": "38ac38bc-d1db-40b5-91ce-68d4d5428ee6", "value": "performanceviewtools.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS20473 the constant company llc", "deleted": false, "disable_correlation": false, "timestamp": "1781218624", "to_ids": true, "type": "ip-dst", "uuid": "bfa28e9c-1887-48b6-b3e1-b669eb4fce2c", "value": "144.202.50.151", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218645", "to_ids": true, "type": "domain", "uuid": "95ac68ce-1f5d-41de-a9ff-10ec8b912a8a", "value": "fiveworkscorp.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218667", "to_ids": true, "type": "hostname", "uuid": "d27683d0-402c-40fd-aa64-ab30547eeb34", "value": "devs.calixcloudinfo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218688", "to_ids": true, "type": "domain", "uuid": "23008b6d-20d4-466e-9caa-e6bf6103f20c", "value": "natsupport.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS20473 the constant company llc", "deleted": false, "disable_correlation": false, "timestamp": "1781218710", "to_ids": true, "type": "ip-dst", "uuid": "27772f14-45d2-4369-ab5f-9c40169d9c60", "value": "149.248.11.71", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215118", "to_ids": true, "type": "sha256", "uuid": "ca368ac1-ed98-4ea1-8027-283daedecb64", "value": "e28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215119", "to_ids": true, "type": "sha256", "uuid": "61585209-5811-4222-92d8-9f5b52e8d0d4", "value": "40d264cf9c73923932c3dfd52d20f46ff602be3fea8dc6ecc71aca46e6067bf5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215120", "to_ids": true, "type": "sha256", "uuid": "18d9f3dc-3527-4d1e-8142-99257decf2bd", "value": "e981fc4eaaa6417e6034e21438e55c0360773674a6fc0b63c1b95026449e5254", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215121", "to_ids": true, "type": "sha256", "uuid": "6c51dedf-7b66-44a5-9bdb-7b2caa0182ee", "value": "ee41e06ed96182ce80cd4544a6abd5d7719c4a5c0e5ddb266a83842d39b99b0a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215121", "to_ids": true, "type": "sha256", "uuid": "407c40ba-4a48-41ab-8c05-3a4ae1aadeb1", "value": "f70abe93112637d3ec2f6c5e058ccac0307ebf63e496f38588cbfc17a8f8a264", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS18779 egihosting", "deleted": false, "disable_correlation": false, "timestamp": "1781218731", "to_ids": true, "type": "ip-dst", "uuid": "92b0685f-3638-4f31-9615-4ecf87c9ddd1", "value": "104.253.1.46", "Tag": [ { "colour": "#0edd96", "local": false, "name": "asn:asn=\"49791\"", "relationship_type": "" }, { "colour": "#e7b09e", "local": false, "name": "asn:as-owner=\"AS-3HCLOUD\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1781218752", "to_ids": true, "type": "ip-dst", "uuid": "ecfffa2c-9c77-4634-8587-c83df4f5a443", "value": "107.175.235.196", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS14061 digitalocean llc", "deleted": false, "disable_correlation": false, "timestamp": "1781218773", "to_ids": true, "type": "ip-dst", "uuid": "61d6851a-7b0a-4288-b943-e83e02cc6aa2", "value": "159.223.77.60", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=CA ASN=AS63949 linode llc", "deleted": false, "disable_correlation": false, "timestamp": "1781218794", "to_ids": true, "type": "ip-dst", "uuid": "772ca860-b837-4586-a610-683d1ea0da85", "value": "170.187.181.243", "Tag": [ { "colour": "#680e86", "local": false, "name": "asn:asn=\"63949\"", "relationship_type": "" }, { "colour": "#edf21f", "local": false, "name": "asn:as-owner=\"AKAMAI-LINODE-AP Akamai Connected Cloud\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1781218815", "to_ids": true, "type": "ip-dst", "uuid": "fe5748d6-85fb-45ab-a346-9dcea9594287", "value": "172.245.5.22", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS8100 quadranet enterprises llc", "deleted": false, "disable_correlation": false, "timestamp": "1781218837", "to_ids": true, "type": "ip-dst", "uuid": "355dcd96-aa48-4b7d-9c22-1bbd7174a8fb", "value": "173.254.201.16", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=IR ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1781218858", "to_ids": true, "type": "ip-dst", "uuid": "4c652a9d-0c1e-49de-85d7-1a6aabe45bd1", "value": "5.223.42.12", "Tag": [ { "colour": "#eb987c", "local": false, "name": "asn:asn=\"215859\"", "relationship_type": "" }, { "colour": "#bbf1ed", "local": false, "name": "asn:as-owner=\"HETZNER-CLOUD4-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=IR ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1781218879", "to_ids": true, "type": "ip-dst", "uuid": "58b43b11-6814-441c-976f-ebf5086a9ef7", "value": "5.223.49.77", "Tag": [ { "colour": "#eb987c", "local": false, "name": "asn:asn=\"215859\"", "relationship_type": "" }, { "colour": "#bbf1ed", "local": false, "name": "asn:as-owner=\"HETZNER-CLOUD4-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=IR ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1781218901", "to_ids": true, "type": "ip-dst", "uuid": "d9777e04-13c7-4095-a51d-191dc8dad57b", "value": "5.223.68.181", "Tag": [ { "colour": "#eb987c", "local": false, "name": "asn:asn=\"215859\"", "relationship_type": "" }, { "colour": "#bbf1ed", "local": false, "name": "asn:as-owner=\"HETZNER-CLOUD4-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS35913 dedipath", "deleted": false, "disable_correlation": false, "timestamp": "1781218922", "to_ids": true, "type": "ip-dst", "uuid": "caaaa9d9-0af0-4f9b-9dc6-14b356e8219c", "value": "66.59.196.250", "Tag": [ { "colour": "#161dc5", "local": false, "name": "asn:asn=\"13649\"", "relationship_type": "" }, { "colour": "#c2a50b", "local": false, "name": "asn:as-owner=\"ASN-FLEXENTIAL\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218944", "to_ids": true, "type": "domain", "uuid": "7b0ac005-31f4-43ba-bd22-73c7c9504473", "value": "barannclinic.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218965", "to_ids": true, "type": "domain", "uuid": "fca55e44-05c6-41a7-8ae9-0de37980d7df", "value": "bititer.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218986", "to_ids": true, "type": "domain", "uuid": "0885e48a-bec6-4586-aa2a-489ad1af4e88", "value": "calixcloudinfo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781219007", "to_ids": true, "type": "domain", "uuid": "d6f24096-c71b-412f-906b-7225a9f4e141", "value": "faoith.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781219029", "to_ids": true, "type": "domain", "uuid": "4ac7c509-a75d-48ad-8ce8-9f54001bcb50", "value": "kitfloor.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781219050", "to_ids": true, "type": "domain", "uuid": "c96d8e1d-af41-4efc-855f-1c20e6602090", "value": "systemsvcs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781219071", "to_ids": true, "type": "hostname", "uuid": "83bb3c4d-474b-402e-b546-74885bac1e63", "value": "www.natsupport.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215122", "to_ids": true, "type": "md5", "uuid": "8b8807ea-626e-4914-a45c-71d5254ec97f", "value": "58d4eccc982c9e9b1b98aa62c514e53a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215123", "to_ids": true, "type": "md5", "uuid": "8b0d166c-eec8-4a7c-a2a4-51e7cba38512", "value": "84ad78b2bab946c3677fdc28ebd8a774", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "PLENET No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215124", "to_ids": true, "type": "md5", "uuid": "4c9de186-7f3c-46fa-9d19-80988e8b481a", "value": "95dc2289427ed29b8b996d0e3d1b78cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215124", "to_ids": true, "type": "md5", "uuid": "579af0ec-a025-4814-ae54-00b7b3268632", "value": "98ee964edeb5a988c3bba8ea1e57fe0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215126", "to_ids": true, "type": "sha1", "uuid": "bb496136-76a1-49bb-9faa-4a7a919e8823", "value": "681075027553546c119ec447eb8df84633dcffce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215127", "to_ids": true, "type": "sha1", "uuid": "a91b628e-caf6-4edb-84a3-401c9cf914e6", "value": "e952c18272efa1c3d73d0a5381bcf443c02743fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215128", "to_ids": true, "type": "sha1", "uuid": "954374ab-3a55-4f1c-8b87-40e1d6ec58d8", "value": "f4d77958a12a0778283d3e679b24b18f82e332c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "PLENET No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215128", "to_ids": true, "type": "sha1", "uuid": "75aaea75-cb7e-453f-b004-232365b7fc47", "value": "f8d93c1769e877aae7e7d5c289a467b5ae371c7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "PLENET No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215129", "to_ids": true, "type": "sha256", "uuid": "cffe4eaa-c3d7-4d02-8f59-f6dce4a8f681", "value": "eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219092", "uuid": "a5c27459-9e2d-4e17-b856-ac54dc84fd33", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219092", "to_ids": true, "type": "md5", "uuid": "b9102529-981c-43ff-bad2-626c228adbbd", "value": "123e80a34508c4dede7cc70e76931fcc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215106", "to_ids": true, "type": "sha1", "uuid": "3b0a2926-1838-4409-b3e5-7066beb14c22", "value": "130fdc32de36a362e65c7138b560eb8d8f6ae599", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215106", "to_ids": true, "type": "sha256", "uuid": "4b974d25-df1d-4e62-a055-27ce4dfd2e26", "value": "2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214325", "to_ids": true, "type": "ssdeep", "uuid": "56aa8697-7591-47c0-a474-91ae09c4046b", "value": "98304:xO0fCa7eFs718NGE3Wr1eAC4HKJw58QRhE:xO0qa7ea71IGE3CPC4HKJY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214325", "to_ids": false, "type": "size-in-bytes", "uuid": "aacce89e-32ac-4156-8f0b-b87073a2b299", "value": "7606272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214325", "to_ids": true, "type": "vhash", "uuid": "971b8eeb-d570-405a-ad16-13b01741e1a9", "value": "2ae4e8508310db9b5a868735969a533c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214325", "to_ids": true, "type": "filename", "uuid": "230b4dc6-c2c9-4fa9-be9d-ea99adf8fb6e", "value": "2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df.elf" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214325", "to_ids": false, "type": "text", "uuid": "f898df14-cb35-4230-ac33-41e4de17433d", "value": "IOC-title:is__elf\nIOC-description:MD5 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df\r\nType Description: ELF\nMicrosoft: Trojan:Linux/BrickStorm!MTB\nVT Total Detection:28/64\nFirst Submission:2025-09-04T18:25:14.000000+00:00\nLast Submission:2026-06-08T12:29:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219113", "uuid": "b5e2c349-41ef-451f-811b-ad304a089e4b", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219113", "to_ids": true, "type": "md5", "uuid": "118bc1c1-9e3f-4dbb-98db-fe7eb9afe1fa", "value": "b1b7aaa5bd4408a4d3003a9fabcdd041", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215108", "to_ids": true, "type": "sha1", "uuid": "7b9fe64d-8a7e-4070-b5e1-d48ccb8d6d13", "value": "b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215108", "to_ids": true, "type": "sha256", "uuid": "2de7d8f7-6dea-4192-ab2e-4f89d743703a", "value": "90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214347", "to_ids": true, "type": "ssdeep", "uuid": "ac17b25e-a1e7-48d2-a9ea-2781f66eb4f4", "value": "196608:5EIbt7uhKu2tGoNiSc+0iwTFOe7o2oa2b:5hZojFqwTZO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214347", "to_ids": false, "type": "size-in-bytes", "uuid": "eb351102-b8af-4eaa-bec2-7aea6f4978e0", "value": "8626176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214347", "to_ids": true, "type": "vhash", "uuid": "062d1676-3e8d-4ed6-a712-a81f4f521468", "value": "2ae4e8508310db9b5a868735969a533c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214347", "to_ids": true, "type": "filename", "uuid": "bd956c5a-e785-4725-9bae-d67dbdec27bd", "value": "pg_update.elf.infected" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214347", "to_ids": false, "type": "text", "uuid": "c949a8e1-4045-425f-9efe-4553664d740a", "value": "IOC-title:is__elf\nIOC-description:MD5 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035\r\nType Description: ELF\nMicrosoft: Trojan:Linux/BrickStorm!MTB\nVT Total Detection:33/64\nFirst Submission:2025-09-04T20:20:58.000000+00:00\nLast Submission:2026-04-04T10:23:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219135", "uuid": "61ea20ae-c068-4024-b915-65889cec85db", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219135", "to_ids": true, "type": "md5", "uuid": "7fbfb349-a5a0-44d0-a622-fe32c5db54b5", "value": "84b573305b732a8372a082c057242953", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215109", "to_ids": true, "type": "sha1", "uuid": "8c226884-5b6b-47c5-a5a1-26c2fa143b20", "value": "f1f64ed1ee74d3b84f338a612e59c81997d6f70e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf\nIOC-description:MD5 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215109", "to_ids": true, "type": "sha256", "uuid": "3e633b5d-9242-4761-ba72-eaa3f6c87816", "value": "aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214369", "to_ids": true, "type": "ssdeep", "uuid": "3bb36888-36b1-4e5f-9af3-9b53dd85447f", "value": "49152:mCs5lonTf5alUiADjP6IHSOwM4x5WBX3ORLmcDfk8HwHbWxkdXxb/guLvoaEMLJu:PssTf5QIjP6IHnsx58uRai9qAa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214369", "to_ids": false, "type": "size-in-bytes", "uuid": "feac81ad-471e-46e0-9141-d68b98ef4bbe", "value": "5844992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214369", "to_ids": true, "type": "vhash", "uuid": "d57e4da1-7579-4e82-b978-b8f409fe4d0c", "value": "2ae4e8508310db9b5a868735969a533c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214369", "to_ids": true, "type": "filename", "uuid": "b750958a-46d7-4376-ac98-f87ffc3c3ded", "value": "aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878.elf" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214369", "to_ids": false, "type": "text", "uuid": "5291e1b9-8295-4591-b715-ffc164cd3078", "value": "IOC-title:is__elf\nIOC-description:MD5 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878\r\nType Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:29/64\nFirst Submission:2025-08-28T18:07:52.000000+00:00\nLast Submission:2026-02-11T19:27:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219156", "uuid": "debb8fec-2147-4224-9726-77a78568ce33", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:MAL_G_APT_Backdoor_BRICKSTORM_3", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219156", "to_ids": true, "type": "md5", "uuid": "66c36464-24ef-4472-8bba-c3b01854a999", "value": "9c44bc9373377831c45dd0ac2661a28e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:MAL_G_APT_Backdoor_BRICKSTORM_3", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215110", "to_ids": true, "type": "sha1", "uuid": "c7c5b0d3-2a4f-41c0-9c37-7c330ef9177d", "value": "b439749a581ac5a29b5c9d91fc092bf4ceaa76a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:MAL_G_APT_Backdoor_BRICKSTORM_3", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215110", "to_ids": true, "type": "sha256", "uuid": "db880e5e-4339-4d91-8b3d-be773ce7fb7c", "value": "320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214391", "to_ids": true, "type": "ssdeep", "uuid": "0fb08fc4-8467-49fb-9e95-50eb9baa2be1", "value": "98304:kGkr2m73VarR3j/21LnvSk+o5UNnAXWH5Uwkmu0ZlfkG3pstaYOE2baWn:kGkr2m73ArR3j/21LnvSk+o5UNnAXWHz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214391", "to_ids": false, "type": "size-in-bytes", "uuid": "3a67e7e7-6663-42b5-8a0f-1a50bfbb6a3f", "value": "5976064" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214391", "to_ids": true, "type": "vhash", "uuid": "bf57a4c8-98ee-4318-8edf-8dc88752f315", "value": "2ae4e8508310db9b5a868735969a533c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214391", "to_ids": true, "type": "filename", "uuid": "dcef26c2-ca39-4a1b-b497-06ffa79e4300", "value": "brickstorm_linux_amd64" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214391", "to_ids": false, "type": "text", "uuid": "0cc3f72e-fe46-41cf-bac8-160c32cc53e3", "value": "IOC-title:MAL_G_APT_Backdoor_BRICKSTORM_3\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/BrickStorm!MTB\nVT Total Detection:27/64\nFirst Submission:2025-11-09T23:51:14.000000+00:00\nLast Submission:2026-01-29T17:42:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219177", "uuid": "7e3716a4-1163-4702-a8fc-8c91296d2092", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219177", "to_ids": true, "type": "md5", "uuid": "1f422467-a0d2-47f5-9bdd-3b90a1c34542", "value": "2654c08491a0f7c4a3dfc6282de5638b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215111", "to_ids": true, "type": "sha1", "uuid": "22d6ffeb-d5a0-47f8-9b2e-b60668b36d81", "value": "4b8ab808442bf7cb084fddf983a558c2cd4b3ff2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215111", "to_ids": true, "type": "sha256", "uuid": "40a9af4f-f3d1-4bb0-8b35-6086c59d2c7f", "value": "24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214413", "to_ids": true, "type": "ssdeep", "uuid": "fbd751af-6207-449e-885d-802109873e85", "value": "98304:C//zl7M481oQdM5JH5eeGU19DGEIZDtAv5Ew+QsrtaDcE:iQ231DtWDyY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214413", "to_ids": false, "type": "size-in-bytes", "uuid": "73c873f5-ff88-43e8-97be-a43af9356865", "value": "8187704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214413", "to_ids": true, "type": "vhash", "uuid": "cea7ef17-c62b-4880-9b1a-ede00440716f", "value": "18e6a1432aa20cb16fa3bfe7655065b9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214413", "to_ids": true, "type": "filename", "uuid": "10fdf750-bd2b-44c3-bca7-f03a191feed2", "value": "support.elf" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214413", "to_ids": false, "type": "text", "uuid": "f76c8f67-b355-4910-89de-86af0dbbaa78", "value": "IOC-title:is__elf\r\nType Description: ELF\nMicrosoft: Trojan:Linux/SAgnt!MSR\nVT Total Detection:27/64\nFirst Submission:2025-12-17T02:47:37.000000+00:00\nLast Submission:2026-05-28T07:27:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219199", "uuid": "48ade250-ef78-40f4-b89d-42ea3ddff994", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1\nIOC-description:MD5 of 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219199", "to_ids": true, "type": "md5", "uuid": "b1b7b4bd-1298-4054-814b-495da7478db3", "value": "625b6535321d58bb5c613e85332bf731", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1\nIOC-description:MD5 of 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215112", "to_ids": true, "type": "sha1", "uuid": "bccc2a8e-2536-4f3b-bc72-009bd71eacf1", "value": "70686215a49afbae21c351e912940e50dbabadd6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1\nIOC-description:MD5 of 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215112", "to_ids": true, "type": "sha256", "uuid": "d8d1a088-bdff-40a7-9845-08da11285a2b", "value": "92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214437", "to_ids": true, "type": "ssdeep", "uuid": "36cfedad-46b1-4253-93e5-b33c515a691d", "value": "96:qB4c2cCCRgR2R2OKpaiQRCoaiQRMIEsqaEbQC/BilUbT6:84c2cCCRgR2R2lpaiQRCoaiQR2I4bT6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214437", "to_ids": false, "type": "size-in-bytes", "uuid": "7ee4c551-7290-4b6d-a080-2f6daf549f3e", "value": "4934" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214437", "to_ids": false, "type": "text", "uuid": "7307b618-c2a3-4d6e-a629-bf696c52cae9", "value": "IOC-title:WEBSHELL_G_APT_BackdoorWebshell_SLAYSTYLE_1\nIOC-description:MD5 of 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a\r\nType Description: Java\nMicrosoft: Trojan:Java/SAgnt!MTB\nVT Total Detection:28/62\nFirst Submission:2025-11-04T03:25:55.000000+00:00\nLast Submission:2025-11-04T03:25:55.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219220", "uuid": "83201bbe-9d4e-4217-b5ea-ed6a15089c1e", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219220", "to_ids": true, "type": "md5", "uuid": "ff693159-31f2-4898-99e1-2d378910b815", "value": "c392262fa86c390a20b998970639a51c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215113", "to_ids": true, "type": "sha1", "uuid": "21495456-3436-4e06-b5a8-b907c94fc9a5", "value": "873f1277a42de5c82f869459e7fb7c94554a642b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215113", "to_ids": true, "type": "sha256", "uuid": "5bcf905a-382a-4065-a410-720f718a0608", "value": "45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214459", "to_ids": true, "type": "ssdeep", "uuid": "dc7e67c0-8ebf-4aea-90c7-b8f0ed2be261", "value": "24576:5tMoPJin3orlbdw1iARcFMcVIH06iyG0Yr:5tMohin3orbw1iARahIU6iQ+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214459", "to_ids": false, "type": "size-in-bytes", "uuid": "95ba7ad7-9577-4ea6-8ccc-4d9e1d794c7f", "value": "1476864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214459", "to_ids": true, "type": "vhash", "uuid": "5b9ab057-d570-4c11-ba0c-73b5a3fac80d", "value": "9ded3c95dce6d765253a733a147e2c5c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214459", "to_ids": true, "type": "filename", "uuid": "c1b210e7-1f59-4a87-a323-604e2332767c", "value": "v3atm.exe" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214459", "to_ids": false, "type": "text", "uuid": "90552fef-b3c1-4998-b209-ac117e38a49d", "value": "IOC-title:is__elf\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/BrickStorm!MSR\nVT Total Detection:27/64\nFirst Submission:2025-08-30T11:38:31.000000+00:00\nLast Submission:2025-08-30T11:38:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219242", "uuid": "38d9d026-a281-4f5d-a600-fee18909ac16", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219242", "to_ids": true, "type": "md5", "uuid": "dcbe9aff-124d-49a4-8a77-d588f164f410", "value": "00e195d94d3b1f7092eb9ed132f89d1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215114", "to_ids": true, "type": "sha1", "uuid": "e57fc78e-e147-4bee-a521-37828ad4c19d", "value": "dbe26539ed4701596371aa585520dd276d437398", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:is__elf", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215114", "to_ids": true, "type": "sha256", "uuid": "7b54ec1d-e099-4b95-a7f7-265452f32c8f", "value": "dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214480", "to_ids": true, "type": "ssdeep", "uuid": "4e84c3a0-b604-477c-ab8f-8508a040f18b", "value": "49152:h/fSU3q/X7rUmFnHfytY2i7xmufhyFtE6g5EbZNCRksjjNuELo9Ikj:h/6UOH34E6g5EvdIjTQIkj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214480", "to_ids": false, "type": "size-in-bytes", "uuid": "9d255bcd-f1eb-485f-965a-a0fffd42c382", "value": "9859072" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781214480", "to_ids": true, "type": "vhash", "uuid": "f2a2a5c1-122d-42e8-950d-ce1beb504d9b", "value": "85cfbfd8fd3db906cc5d17ba84429c0e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214480", "to_ids": true, "type": "filename", "uuid": "19750da3-cd6e-4c6c-9d90-0d3b7fc872f5", "value": "dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591.so" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214480", "to_ids": false, "type": "text", "uuid": "f9b28a34-2609-47fe-a751-7292b867e467", "value": "IOC-title:is__elf\r\nType Description: ELF\nMicrosoft: Trojan:Linux/SAgnt!MSR\nVT Total Detection:34/64\nFirst Submission:2025-12-22T16:16:48.000000+00:00\nLast Submission:2026-06-08T12:36:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781219263", "uuid": "ab6833dc-f22f-43f8-9b85-ea3874897500", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:WEBSHELL_JSP_Generic", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781219263", "to_ids": true, "type": "md5", "uuid": "46d7a5d0-3185-4c03-8453-3c42f464a1cf", "value": "4931441cae81aaefa80d65d7cce4e1ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:WEBSHELL_JSP_Generic", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215115", "to_ids": true, "type": "sha1", "uuid": "e84da896-4a31-470b-94ef-79727c710633", "value": "458653300b48c90a8659b9e9cadc13717bce42b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:WEBSHELL_JSP_Generic", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215115", "to_ids": true, "type": "sha256", "uuid": "99099603-1290-4d0d-9bb7-03ebba6176f5", "value": "f06457d2be0840faac9f0a91e63e33f932bf82922b25ac8c046fab38bb1e0b36", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214587", "to_ids": true, "type": "ssdeep", "uuid": "a52cf253-4b01-4d5d-a98c-84f7739385e7", "value": "24:InX4AF9GWTtcTtmSugYA9iTtmkmzSRvlLJIH0TLwMoaGiM2lmy6RItbQ:SX4AWAimSugbymjSRvR/HJnQRItc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214587", "to_ids": false, "type": "size-in-bytes", "uuid": "be8eb59b-27da-437c-9d66-8571bc38175e", "value": "1327" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214587", "to_ids": true, "type": "filename", "uuid": "a0e6ab64-1434-4735-a807-4acec254eb6d", "value": "index.jsp.txt" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214587", "to_ids": false, "type": "text", "uuid": "eb8983ae-2033-404c-a396-5bfcc5bf358e", "value": "IOC-title:WEBSHELL_JSP_Generic\r\nType Description: Text\nMicrosoft: None\nVT Total Detection:15/62\nFirst Submission:2025-12-03T03:41:38.000000+00:00\nLast Submission:2025-12-03T03:41:38.000000+00:00" } ] } ] } }