{ "Event": { "analysis": "1", "date": "2026-07-21", "extends_uuid": "", "info": "[Threat Intel] New Project CAV3RN .NET Native AOT communication module", "protected": false, "publish_timestamp": "1785033941", "published": true, "threat_level_id": "3", "timestamp": "1785033940", "uuid": "bbe89bc0-bdf6-4f21-8932-4e4225dbc3d5", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"", "relationship_type": "" }, { "colour": "#110e53", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#9e0269", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#23cf0e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"", "relationship_type": "" }, { "colour": "#08b028", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#40fad1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"", "relationship_type": "" }, { "colour": "#26fab6", "local": false, "name": "misp-galaxy:target-information=\"Israel\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003f", "local": false, "name": "rectifyq:sub-category=\"tool-profile\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784718006", "to_ids": false, "type": "link", "uuid": "9a05d06f-5b5b-4def-86d2-c40f28155a5b", "value": "https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784718006", "to_ids": false, "type": "text", "uuid": "6199b53a-bb4c-405d-9b65-c27e1c0872e0", "value": "Kaspersky identified a new .NET Native AOT communication module for Project CAV3RN, a sophisticated cyberespionage framework targeting Israel. This module replaces the previous HTTP/WebSocket component by exchanging commands through Outlook calendar events accessed via Microsoft Graph API. Commands and results are stored in a fixed time window (2050-05-13 22:00-23:00 UTC) using specific subject patterns to identify heartbeats, commands, and outputs. The module implements RSA and AES-GCM encryption for secure communications. If Microsoft Graph authentication fails, it retrieves replacement configuration settings through DNS AAAA record responses from actor-controlled nameservers. The infrastructure analysis and behavioral patterns suggest low-confidence attribution to OilRig (APT34), based on the use of Microsoft-hosted services for command and control and compromised regional infrastructure." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784718006", "to_ids": false, "type": "text", "uuid": "35546464-381f-4f3e-89ef-1cb4add1c68c", "value": "Name: New Project CAV3RN .NET Native AOT communication module\nAuthor: AlienVault\nAdversary: CHRYSENE\nTags: [\"veaty\", \"whisper\", \"encryption\", \"sc5k\", \"israel\", \"dns aaaa\", \"rdat\", \"cav3rn\", \"project cav3rn\", \"oilcheck\", \"oilbooster\", \"solar\", \"outlook calendar\", \"cyberespionage\", \"microsoft graph\", \"apt34\"]\nTgtd countries: [\"Israel\"]\nMlwr families: [\"CAV3RN\", \"RDAT - S0495\", \"SC5k\", \"OilCheck\", \"OilBooster\", \"Solar\", \"WhisperGate - S0689\", \"Veaty\"]\nAttack_ids: [\"T1132.001\", \"T1568.002\", \"T1071.004\", \"T1573.001\", \"T1140\", \"T1055\", \"T1059\", \"T1102\", \"T1041\", \"T1078\", \"T1027\", \"T1114.002\", \"T1573.002\", \"T1567.002\", \"T1027.002\", \"T1071.001\", \"T1105\", \"T1008\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784718006", "to_ids": false, "type": "threat-actor", "uuid": "3b031a90-a577-4e9a-947b-0463cf5a02bf", "value": "CHRYSENE" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033642", "to_ids": true, "type": "domain", "uuid": "52b8d41e-9e06-431b-b040-7e82f57e2120", "value": "cloudlanecdn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033663", "to_ids": true, "type": "domain", "uuid": "9032aa69-a6df-4ed5-9325-b0dfab6a7f43", "value": "clipeditskill.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033683", "to_ids": true, "type": "domain", "uuid": "931143ae-da7b-4bf2-8530-cb979a1a73e0", "value": "accesslinkssl.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033704", "to_ids": true, "type": "hostname", "uuid": "c914d619-4144-4cdd-8238-dc4b478a64e2", "value": "d.53466d4c67515a.0.p.cloudlanecdn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033726", "to_ids": true, "type": "hostname", "uuid": "8e46ae28-3959-4b1f-8497-374140c62170", "value": "google.com.ayalon-print.co.il", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033747", "to_ids": true, "type": "hostname", "uuid": "d33beaba-dde5-4094-8149-1a90162306fe", "value": "ns1.cloudlanecdn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033768", "to_ids": true, "type": "hostname", "uuid": "2ea4fa25-3c87-4eca-bf27-90d614dc8196", "value": "ns2.cloudlanecdn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033790", "to_ids": true, "type": "hostname", "uuid": "f7b25225-3290-423a-a5c3-c95827a9d273", "value": "ns3.cloudlanecdn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785033811", "to_ids": true, "type": "hostname", "uuid": "8ce4e78d-1df0-4310-bf3a-bfbc64be05cb", "value": "ns4.cloudlanecdn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785033832", "uuid": "2cd28b7d-adb3-4cd7-9299-ef72935b2873", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "md5", "timestamp": "1785033832", "to_ids": true, "type": "md5", "uuid": "c3abaf44-4cfd-42f7-8e72-c9a127820fac", "value": "caf021dda726b8ba049c2aa395e505a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "sha1", "timestamp": "1784899564", "to_ids": true, "type": "sha1", "uuid": "0e55e40c-6e57-49ec-a22f-65581019710b", "value": "83ed3f17a83b083246f90011d33861cdb5734ab3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "sha256", "timestamp": "1784899564", "to_ids": true, "type": "sha256", "uuid": "fc14cd01-e79b-4dea-8f46-a7778f0049e9", "value": "75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "text", "timestamp": "1784899260", "to_ids": false, "type": "text", "uuid": "0d94ba32-7032-4665-8da7-ae6a9a9e6227", "value": "Type Description: Win32 DLL\nOriginal name: AzureCommunication.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2026-06-07T15:32:18+00:00\nFirst Submission: 2026-06-07T13:31:55+00:00\nLast Submission: 2026-06-07T13:31:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "creation-time", "timestamp": "1784899260", "to_ids": false, "type": "datetime", "uuid": "c5fd20b2-2b5d-4edd-ae6f-0f207c15daf4", "value": "2026-05-19T14:39:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "ssdeep", "timestamp": "1784899260", "to_ids": true, "type": "ssdeep", "uuid": "985a3a94-18a7-49be-a73f-9beb6665640f", "value": "98304:aU60WM8VPosc9STE8UUx6lzEASp0kRYRGNs1aNkssW2:aU6c8poseaErEAgyRGyaNtO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784899260", "to_ids": false, "type": "size-in-bytes", "uuid": "a73b5e85-b446-48e1-9178-0c3b6aa851ef", "value": "12705792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "vhash", "timestamp": "1784899260", "to_ids": true, "type": "vhash", "uuid": "dedb5482-de64-4fd1-b70f-77e76df1c483", "value": "117066656d1565155122z1c2z9c7z7kz1a5z28" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T13:31:55+00:00", "last_seen": "2026-06-07T13:31:55+00:00", "object_relation": "filename", "timestamp": "1784899260", "to_ids": true, "type": "filename", "uuid": "61b53726-f317-4e4c-89cd-e9bb40555e78", "value": "AzureCommunication.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785033853", "uuid": "8ec32d9b-f2a9-46ff-92a6-6132bae5daab", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "md5", "timestamp": "1785033853", "to_ids": true, "type": "md5", "uuid": "4a5b5c57-a871-413b-90ee-301e2fd6171f", "value": "c092b02fbc0fdf7ee9608dd016673806", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "sha1", "timestamp": "1784899565", "to_ids": true, "type": "sha1", "uuid": "81f6f34e-2da8-4cea-81bf-c3340a9c3c9d", "value": "beb57441b81e56d1d7ba72acd841f2ffe171a325", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "sha256", "timestamp": "1784899565", "to_ids": true, "type": "sha256", "uuid": "58081417-f210-4b82-abcb-b20df11aff4e", "value": "b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "text", "timestamp": "1784899283", "to_ids": false, "type": "text", "uuid": "d359f936-8173-461b-adae-fa6b30170f9d", "value": "Type Description: Win32 DLL\nOriginal name: NewProject.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 35/74\nFirst Seen In The Wild: 2026-07-02T12:27:48+00:00\nFirst Submission: 2026-07-02T09:44:40+00:00\nLast Submission: 2026-07-02T09:44:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "creation-time", "timestamp": "1784899283", "to_ids": false, "type": "datetime", "uuid": "2cd93969-fe43-48cb-a1fd-6b45cd63ef41", "value": "2026-07-02T09:43:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "ssdeep", "timestamp": "1784899283", "to_ids": true, "type": "ssdeep", "uuid": "523c9022-e5b7-4041-8cf9-60a7858c769f", "value": "98304:pFO48YE0tGa5SI8mXiAyJOHL83bGTI+GYJO8K:pFO4vUa5Sjsi883KI+GcO8K" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1784899283", "to_ids": false, "type": "size-in-bytes", "uuid": "495eef9b-f7f0-45c9-9f68-4e961788d8ba", "value": "12705792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "vhash", "timestamp": "1784899283", "to_ids": true, "type": "vhash", "uuid": "f7c1c33a-c5d3-4485-863b-bf023c66be6e", "value": "117066656d1565155122z1c2z9c7z7kz1a5z28" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T09:44:40+00:00", "last_seen": "2026-07-02T09:44:40+00:00", "object_relation": "filename", "timestamp": "1784899283", "to_ids": true, "type": "filename", "uuid": "ba4384f1-acee-4487-bd5f-aebb50d7a042", "value": "NewProject.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785033874", "uuid": "09433c60-66bf-4012-8581-e00628a5ae8d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "md5", "timestamp": "1785033874", "to_ids": true, "type": "md5", "uuid": "88da889c-8006-4505-b330-dd34bd7a2e1d", "value": "29b2b8c5d99f05bfcdd0d8d976eb5678", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "sha1", "timestamp": "1784899566", "to_ids": true, "type": "sha1", "uuid": "458101ec-66be-4458-b652-fe70051024bc", "value": "66c8a4d782ec9e19d67f426376e0ebb5af868590", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "sha256", "timestamp": "1784899566", "to_ids": true, "type": "sha256", "uuid": "74ea9d7f-c099-41e2-afeb-33759ce8edde", "value": "f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "text", "timestamp": "1784899305", "to_ids": false, "type": "text", "uuid": "5b5578a0-0a75-4722-b9e2-39b3b6d8edb4", "value": "Type Description: Win32 DLL\nOriginal name: AzureCommunication.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 37/74\nFirst Seen In The Wild: 2026-07-02T11:34:54+00:00\nFirst Submission: 2026-07-02T09:34:27+00:00\nLast Submission: 2026-07-02T09:34:27+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "creation-time", "timestamp": "1784899305", "to_ids": false, "type": "datetime", "uuid": "7218a2fa-3df3-4d99-ad75-47171fb41b02", "value": "2026-05-27T09:40:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "ssdeep", "timestamp": "1784899305", "to_ids": true, "type": "ssdeep", "uuid": "04996714-7c1b-45f8-af93-ec84509bd094", "value": "98304:ZUS8xp6ZuLjXmD/Wgl706m5RASp0kRYRGBs1askssW:ZUSE6ILj2jWxRAgyRGWast" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1784899305", "to_ids": false, "type": "size-in-bytes", "uuid": "52d07688-7fde-4881-b12d-1a0eb1d0ee7a", "value": "12705792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "vhash", "timestamp": "1784899305", "to_ids": true, "type": "vhash", "uuid": "6efc5d18-25be-4433-95e6-95af630c3d83", "value": "117066656d1565155122z1c2z9c7z7kz1a5z28" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T09:34:27+00:00", "last_seen": "2026-07-02T09:34:27+00:00", "object_relation": "filename", "timestamp": "1784899305", "to_ids": true, "type": "filename", "uuid": "1b134216-d3f7-4ce4-9047-824dc9a47d45", "value": "AzureCommunication.dll" } ] } ] } }