{ "Event": { "analysis": "1", "date": "2026-06-28", "extends_uuid": "", "info": "[Threat Intel] India's government and energy sectors targeted with ZOHOMURK and MINIRECON", "protected": false, "publish_timestamp": "1783115665", "published": true, "threat_level_id": "2", "timestamp": "1783115664", "uuid": "bd567493-ebee-4682-9505-48c1b3f8f215", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#f4b62b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"8545fbf3-a246-4938-96a9-85a24651ebde\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MUSTANG PANDA\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Energy\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Myanmar\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ShadowPad\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"TONESHELL\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782874807", "to_ids": false, "type": "link", "uuid": "3a7c2cd8-f142-45ba-8ce1-12f6479ec3bd", "value": "https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782874807", "to_ids": false, "type": "text", "uuid": "c2b07458-2fa5-4ac4-89f9-188b5e0bd1a1", "value": "Mustang Panda orchestrated two concurrent espionage campaigns targeting Indian government entities and hydropower infrastructure between May and June 2026. The campaigns leveraged DLL sideloading via legitimate executables to deploy newly identified malware including SHARDLOADER, MINIRECON, and ZOHOMURK. MINIRECON represents an evolution of Toneshell with WebSocket-based command-and-control capabilities, while ZOHOMURK abuses Zoho WorkDrive cloud services for C2 communications and data exfiltration. Distribution occurred through spear-phishing with lures themed around India-Taiwan cooperation agreements and hydropower projects. The activity demonstrates code overlaps with previous tooling, infrastructure proximity to known operations, and targeting patterns aligned with Chinese strategic intelligence collection priorities. Multiple compromised government systems were identified, with coordination conducted through CERT-In for victim notification and remediation." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782874807", "to_ids": false, "type": "text", "uuid": "f59f2e2d-3a87-4a3f-9f6a-83743a239adc", "value": "Name: India's government and energy sectors targeted with ZOHOMURK and MINIRECON\nAuthor: AlienVault\nAdversary: MUSTANG PANDA\nTags: [\"india\", \"government targeting\", \"websocket\", \"minirecon\", \"zohomurk\", \"shadowpad\", \"cloud c2\", \"hydropower\", \"espionage\", \"pubload\", \"shardloader\", \"toneshell\", \"zoho workdrive\", \"dll sideloading\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\"]\nMlwr families: [\"SHARDLOADER\", \"MINIRECON\", \"ZOHOMURK\", \"TONESHELL\", \"PUBLOAD\", \"ShadowPad - S0596\", \"POISONPLUG.SHADOW\"]\nAttack_ids: [\"T1053.005\", \"T1033\", \"T1036.005\", \"T1566.001\", \"T1082\", \"T1106\", \"T1140\", \"T1055\", \"T1497.003\", \"T1112\", \"T1016\", \"T1083\", \"T1041\", \"T1547.001\", \"T1027\", \"T1567.002\", \"T1059.003\", \"T1071.001\", \"T1574.002\", \"T1105\"]\nIndustries: [\"Government\", \"Energy\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783073962", "to_ids": false, "type": "threat-actor", "uuid": "d0cb099a-ed21-4600-9ee7-ba60660d4dbd", "value": "MUSTANG PANDA", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MUSTANG PANDA\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783098976", "to_ids": true, "type": "domain", "uuid": "eb454260-3420-4671-b5f7-7419e6591d2c", "value": "couldinstallup.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783098997", "to_ids": true, "type": "url", "uuid": "83d3e205-958a-44ee-bb00-d4caf8ff42bd", "value": "http://www.zohoapis.com/workdrive/api/v1/files", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783099018", "to_ids": true, "type": "hostname", "uuid": "dadcbad4-fb3d-4a57-9de8-46bfe8bdb6b2", "value": "www.zohoapis.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099039", "uuid": "deea8a12-ecc5-4984-a5b1-7aabb086c311", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "md5", "timestamp": "1783099039", "to_ids": true, "type": "md5", "uuid": "f3ae7f43-c0a9-40fe-9231-86f16ec1dde0", "value": "c04c947efdfdd9ce24617903b6746a83", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "sha1", "timestamp": "1783096978", "to_ids": true, "type": "sha1", "uuid": "2ece08e7-5fd5-4a74-8f72-3d51fd53f5f4", "value": "43d646eda4166261eb1433c7599bf5cc9129a4f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "sha256", "timestamp": "1783096978", "to_ids": true, "type": "sha256", "uuid": "08aec347-2cdf-4feb-bd5a-0a2715b38827", "value": "fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "text", "timestamp": "1783095548", "to_ids": false, "type": "text", "uuid": "f0bfbf08-8a2e-45e1-aca8-8aadbb75fbc7", "value": "Type Description: Win32 EXE\nOriginal name: Solid PDF Creator\nVerified: Signed\nSigning date: 05:25 PM 06/03/2014\nSigners: Solid Documents; VeriSign Class 3 Code Signing 2010 CA; VeriSign\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Seen In The Wild: 2016-12-19T11:59:11+00:00\nFirst Submission: 2015-09-28T14:47:46+00:00\nLast Submission: 2026-07-02T07:27:21+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "creation-time", "timestamp": "1783095548", "to_ids": false, "type": "datetime", "uuid": "6e5f3d10-4d45-4e96-82a9-e8d50840ca0d", "value": "2014-06-03T17:19:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "ssdeep", "timestamp": "1783095548", "to_ids": true, "type": "ssdeep", "uuid": "52395238-a13d-49e3-be7f-96ad65a71a7a", "value": "49152:tXnulPRNaHAPM1ICw3qHZDlrqdWRyZNtoXwU7sk+TBV99yhW4iHp8p0:5uHNagPGICw3qHZhrW1ZPoXakyV99yhu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095548", "to_ids": false, "type": "size-in-bytes", "uuid": "4545b46c-0376-4a7f-a3fb-ceae250bda1d", "value": "1574184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "vhash", "timestamp": "1783095548", "to_ids": true, "type": "vhash", "uuid": "e7c80637-199d-496a-882f-4af575e7821b", "value": "016046655d5550b0201006100966z210d5z90500dc3z19z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2015-09-28T14:47:46+00:00", "last_seen": "2026-07-02T07:27:21+00:00", "object_relation": "filename", "timestamp": "1783095548", "to_ids": true, "type": "filename", "uuid": "11981216-09b8-4f61-9d01-88f408d11613", "value": "Solid PDF Creator" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099061", "uuid": "6fcbe8c5-62f7-46cd-9737-b2426405a3d3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "md5", "timestamp": "1783099061", "to_ids": true, "type": "md5", "uuid": "f1e0bad8-390b-4d9d-876c-f9bdb40df22e", "value": "caac47be757eddd0d36976c0f6e99962", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "sha1", "timestamp": "1783096979", "to_ids": true, "type": "sha1", "uuid": "db821e7a-5c11-488b-9cb2-487893d548fe", "value": "d2f47e427a5705ccb158012e2c6dbae3d5c37a21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "sha256", "timestamp": "1783096979", "to_ids": true, "type": "sha256", "uuid": "b2170663-bd84-45d2-b0c3-4c4aff4f4f2d", "value": "390148f5157c0f6b337ff19d162c3c2ee3e6d782fdfbe11fb1e411c0684fd33b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "text", "timestamp": "1783095570", "to_ids": false, "type": "text", "uuid": "948bb879-5eb0-4fc5-9d38-815aaa4fcaa0", "value": "Type Description: MS Word Document\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2026-06-19T04:31:57+00:00\nFirst Submission: 2026-06-04T05:54:34+00:00\nLast Submission: 2026-06-12T13:01:52+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "creation-time", "timestamp": "1783095570", "to_ids": false, "type": "datetime", "uuid": "ccd0fd3f-63f2-4197-8fb5-d7ea7019d505", "value": "2026-03-21T07:10:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "ssdeep", "timestamp": "1783095570", "to_ids": true, "type": "ssdeep", "uuid": "adeae886-5e3e-4dbf-8756-ccbd8d2a1205", "value": "12288:SZhBHdNTxZhBHdNTx5hBHdNTxAhBHdNTxGhBHdNTxhiVV:SlLLLPLuL8LW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095570", "to_ids": false, "type": "size-in-bytes", "uuid": "e2593c6a-1a20-4cd7-9798-ca3b1d01f8a1", "value": "681472" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "vhash", "timestamp": "1783095570", "to_ids": true, "type": "vhash", "uuid": "6ddf5b68-7e21-4eec-9240-4c3d49d59f2c", "value": "cd39f189801e7430994f0f7f844b4366" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T05:54:34+00:00", "last_seen": "2026-06-12T13:01:52+00:00", "object_relation": "filename", "timestamp": "1783095570", "to_ids": true, "type": "filename", "uuid": "c9568bd6-6329-404d-9b83-9d5fd32a1ee2", "value": "test.doc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099082", "uuid": "b5877d43-4a19-482e-9825-8eb4db9187b1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "md5", "timestamp": "1783099082", "to_ids": true, "type": "md5", "uuid": "55b6c197-08bc-4c86-8eb7-4466df2c7ecf", "value": "b267acd1b7c15b18178ae9fd4974f3f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "sha1", "timestamp": "1783096980", "to_ids": true, "type": "sha1", "uuid": "aecc7ec1-646a-423d-9177-940041d049ad", "value": "8aeba3c711eaa0116807c66390284dfa572d2cc7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "sha256", "timestamp": "1783096980", "to_ids": true, "type": "sha256", "uuid": "3df98c3a-295b-44d9-b275-90dd74a22593", "value": "f53fd0626404a129dcddb8ee7589387dd7bda7999814e0df46c670af6b3da5f5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "text", "timestamp": "1783095591", "to_ids": false, "type": "text", "uuid": "3048e1c8-8e27-417b-acd0-fa9c3545686c", "value": "Type Description: ZIP\nMicrosoft: Trojan:Unix/Casdet!rfn\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2026-06-12T12:48:25+00:00\nFirst Submission: 2026-06-11T12:32:37+00:00\nLast Submission: 2026-07-01T09:05:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "ssdeep", "timestamp": "1783095591", "to_ids": true, "type": "ssdeep", "uuid": "42077ed3-35a3-4cc3-b24a-5187a9d95019", "value": "98304:kJgyONYo5CjaEKz/wJ+IN+LbgkNLJWra/h:kJj2VDwJ+5LbhNLJCUh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095591", "to_ids": false, "type": "size-in-bytes", "uuid": "13854c29-dbd9-4a70-a7eb-5d7a2705d636", "value": "3300714" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "vhash", "timestamp": "1783095591", "to_ids": true, "type": "vhash", "uuid": "4a2bcfb9-b610-4257-95d4-1fc90bdb3d3c", "value": "4765823da82e1d3aef7b6e1c7aa98b99" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:32:37+00:00", "last_seen": "2026-07-01T09:05:55+00:00", "object_relation": "filename", "timestamp": "1783095591", "to_ids": true, "type": "filename", "uuid": "8787e7d4-f4a5-4338-8ba2-0ef584e47fb6", "value": "f53fd0626404a129dcddb8ee7589387dd7bda7999814e0df46c670af6b3da5f5.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099103", "uuid": "6cc6af07-42a0-4d69-951a-6706c45388db", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "md5", "timestamp": "1783099103", "to_ids": true, "type": "md5", "uuid": "a10351b8-ce2d-497c-9ce1-2944efc76b24", "value": "7e7b30071565773d480578537ee3b0e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "sha1", "timestamp": "1783096982", "to_ids": true, "type": "sha1", "uuid": "65642b99-a208-477c-86ab-d865f7182a99", "value": "bca1e295acaacbb19c7e3a7868746f6b772b7b71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "sha256", "timestamp": "1783096982", "to_ids": true, "type": "sha256", "uuid": "6f55ce6a-e75d-42dd-9a50-2cbbbb560018", "value": "a43084f5af861f44c75c5273c779cb26d506cab6b51c33746626da504148a4ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "text", "timestamp": "1783095613", "to_ids": false, "type": "text", "uuid": "a8caa709-69c9-41c4-8013-e12f880386fc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 39/74\nFirst Seen In The Wild: 2026-06-12T10:12:35+00:00\nFirst Submission: 2026-06-11T12:33:54+00:00\nLast Submission: 2026-06-15T05:57:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "creation-time", "timestamp": "1783095613", "to_ids": false, "type": "datetime", "uuid": "3810b911-3949-4d5d-82c6-68e7fa3b54f7", "value": "2026-06-11T07:50:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "ssdeep", "timestamp": "1783095613", "to_ids": true, "type": "ssdeep", "uuid": "95638e33-5cfe-4ed8-b6c8-7aa5a84f7ee8", "value": "49152:VQKfaknyDEOVbH6Ygzu0wJuZIPVnJ+II/VC+N3JWi98yDpyS:PfaknyDEgyzpwJqI7+ntC+N3JW9yN9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095613", "to_ids": false, "type": "size-in-bytes", "uuid": "0e25bb70-83d9-4288-9cfc-2e5f3dee5e97", "value": "2520064" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "vhash", "timestamp": "1783095613", "to_ids": true, "type": "vhash", "uuid": "656e22f1-2b38-41aa-886a-5e0f15312a65", "value": "126076657d151d15555az197z304lz34z6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:33:54+00:00", "last_seen": "2026-06-15T05:57:32+00:00", "object_relation": "filename", "timestamp": "1783095613", "to_ids": true, "type": "filename", "uuid": "24ab2ecf-1505-4c1d-855b-95c4987a372d", "value": "SolidPDFCreator.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099124", "uuid": "2eac4e51-bdd0-4671-94a0-2ae0a06f4fc7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "md5", "timestamp": "1783099124", "to_ids": true, "type": "md5", "uuid": "b48031b4-bc8d-4ea6-bda7-a7b9a7c30260", "value": "6b8111fb3872af45882278c794b74bdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "sha1", "timestamp": "1783096984", "to_ids": true, "type": "sha1", "uuid": "0e284306-615e-466a-809d-5cefbe10a6e1", "value": "dd599bf489bd545edfe0909cf9ef4f3e29f8f0e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "sha256", "timestamp": "1783096984", "to_ids": true, "type": "sha256", "uuid": "f44dfa57-b60e-49a7-85cb-80f841300554", "value": "5f22ec5c14dfd47c92850a5fb3bd8e3754d538b8021b6238238e4020336cfb5c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "text", "timestamp": "1783095634", "to_ids": false, "type": "text", "uuid": "da431aca-79aa-4437-bb63-2c00b20cf915", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Vigorf.A\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2026-06-05T10:12:20+00:00\nFirst Submission: 2026-06-04T09:30:34+00:00\nLast Submission: 2026-07-02T09:40:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "creation-time", "timestamp": "1783095635", "to_ids": false, "type": "datetime", "uuid": "4c84989f-a78b-4010-9afa-14c64d7bc9be", "value": "2026-06-02T20:24:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "ssdeep", "timestamp": "1783095634", "to_ids": true, "type": "ssdeep", "uuid": "8dfab51e-3379-44cc-b441-436557eb2cdb", "value": "6144:KpyFm9hUAXnPHfSE/OZ5NC8L3QC67vWufxo7/:KNfKQOrh3U6Ax2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095634", "to_ids": false, "type": "size-in-bytes", "uuid": "1f7350e2-3526-4802-b901-565d0f0cbb8e", "value": "319488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "vhash", "timestamp": "1783095634", "to_ids": true, "type": "vhash", "uuid": "251729de-497b-4a9b-8962-6e6b8e77a303", "value": "135066655d1d05556038z65hz23z1ez3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T09:30:34+00:00", "last_seen": "2026-07-02T09:40:45+00:00", "object_relation": "filename", "timestamp": "1783095634", "to_ids": true, "type": "filename", "uuid": "6b59bcf5-7148-4498-bc2c-59e197d18a07", "value": "_5f22ec5c14dfd47c92850a5fb3bd8e3754d538b8021b6238238e4020336cfb5c.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099146", "uuid": "c112c2bf-ca8a-403a-814c-02ae67088f29", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "md5", "timestamp": "1783099146", "to_ids": true, "type": "md5", "uuid": "6dde7f1e-cea6-47eb-9257-f4be387b92f7", "value": "ef852bfa40c5f41068136dceb8d22951", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "sha1", "timestamp": "1783096985", "to_ids": true, "type": "sha1", "uuid": "60975108-f4b4-46aa-ab54-5744b7f74c15", "value": "d7f9d6109ff5f9e5669ad93a6fac7c32226965e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "sha256", "timestamp": "1783096985", "to_ids": true, "type": "sha256", "uuid": "4ef9cc68-d437-4b8b-919e-45c685ae41d5", "value": "cd9397797216fd4c08df324937509124e57258328c8e4c6d795c6a2cd25b69b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "text", "timestamp": "1783095656", "to_ids": false, "type": "text", "uuid": "5cca39b9-1009-431d-a8f9-b256def71d3b", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2026-05-28T12:49:30+00:00\nFirst Submission: 2026-05-28T05:09:50+00:00\nLast Submission: 2026-05-28T05:38:40+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "ssdeep", "timestamp": "1783095656", "to_ids": true, "type": "ssdeep", "uuid": "4cdf07b8-df71-46b9-a120-2b73c0acec3b", "value": "24576:sIxALhlgrwY64DF3qnuhLTTAp1QKSrKybZYlRF4T9:AN2rwY13S0Ap1QXyDA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095656", "to_ids": false, "type": "size-in-bytes", "uuid": "d041bea2-191a-4c76-a0ce-0e57add08032", "value": "871080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "vhash", "timestamp": "1783095656", "to_ids": true, "type": "vhash", "uuid": "c97397e2-36ed-4621-91ea-f54d3aac7683", "value": "a26c39665ed142ccb3ded1600ce8437a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T05:09:50+00:00", "last_seen": "2026-05-28T05:38:40+00:00", "object_relation": "filename", "timestamp": "1783095656", "to_ids": true, "type": "filename", "uuid": "c43c063e-17e3-4cf9-b770-90f80d648e49", "value": "Hydropower Cooperation Project Proposal.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099167", "uuid": "da3b9249-ea34-44d4-9d55-de2b4f4a4c80", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "md5", "timestamp": "1783099167", "to_ids": true, "type": "md5", "uuid": "bc9a68fd-5276-4e31-b838-87de4b80f34b", "value": "028c8658580e8f41da4202a141527f2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "sha1", "timestamp": "1783096986", "to_ids": true, "type": "sha1", "uuid": "5e3d8a07-73e3-477a-95e5-4158cbc3342e", "value": "747fa43be6508a256ad19b9cdc78215ffb5e355f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "sha256", "timestamp": "1783096986", "to_ids": true, "type": "sha256", "uuid": "c37f0fdb-85f8-4373-a314-98b1475687b5", "value": "ebd533de7ca16daa70093b0b1084fb6136b6ba091d6ee0e4199762581e1b2e5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "text", "timestamp": "1783095677", "to_ids": false, "type": "text", "uuid": "078509ef-715e-48e3-a6a0-1ac90776b4b4", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/TedySide.YDS!MTB\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-05-28T10:11:57+00:00\nFirst Submission: 2026-05-28T05:10:10+00:00\nLast Submission: 2026-05-28T05:10:10+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "creation-time", "timestamp": "1783095678", "to_ids": false, "type": "datetime", "uuid": "dab7c641-9c1b-47e6-aa21-f99d2d4f6a9b", "value": "2026-05-14T06:32:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "ssdeep", "timestamp": "1783095677", "to_ids": true, "type": "ssdeep", "uuid": "ba0227b9-fa2a-4f0a-b2bc-e4d24095b63a", "value": "3072:UEjI/dDYjeWeIM77tXePyuW+ox2uUqxmbPV4xp6U+TxnMi4n8HGMIro+gSxRk5ol:jKez/UrxlphYRxn/VAwc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095677", "to_ids": false, "type": "size-in-bytes", "uuid": "84cfdeff-9053-4b8b-970d-8d52016b16d9", "value": "181760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "vhash", "timestamp": "1783095677", "to_ids": true, "type": "vhash", "uuid": "54786f47-5d22-401b-913b-f6a51740a80f", "value": "115066657d1515556038z4dnz1ez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T05:10:10+00:00", "last_seen": "2026-05-28T05:10:10+00:00", "object_relation": "filename", "timestamp": "1783095677", "to_ids": true, "type": "filename", "uuid": "67185869-8566-46c4-b00f-a370aa94a0c0", "value": "SolidPDFCreator.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783099188", "uuid": "2f77bed8-42c5-438f-8cd7-116b9bcdb024", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "md5", "timestamp": "1783099188", "to_ids": true, "type": "md5", "uuid": "2eaaf9a0-2ef4-4308-942c-c5f49877cea5", "value": "ad1d161282dffec602c59b18434ee492", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "sha1", "timestamp": "1783096987", "to_ids": true, "type": "sha1", "uuid": "bf30cda8-e4ae-4b08-8bf8-c2e18e5711a2", "value": "9899e7195e1143f746f1e86e92029d813e1baaf8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "sha256", "timestamp": "1783096987", "to_ids": true, "type": "sha256", "uuid": "445167d3-62c2-49ef-b7aa-a00629d70440", "value": "f2bed071676feb831ed460489643fd57f6c6c1e0d024a1ea447820276fb13828", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "text", "timestamp": "1783095699", "to_ids": false, "type": "text", "uuid": "fbb43e49-eb42-4127-86e0-90f821dbdbd3", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Vigorf.A\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2026-06-19T04:22:07+00:00\nFirst Submission: 2026-06-11T12:36:35+00:00\nLast Submission: 2026-07-01T02:41:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "creation-time", "timestamp": "1783095699", "to_ids": false, "type": "datetime", "uuid": "5fd0df51-6b58-4bfc-a8f6-aeb822356ed8", "value": "2026-06-08T22:48:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "ssdeep", "timestamp": "1783095699", "to_ids": true, "type": "ssdeep", "uuid": "71765eb3-bd9d-4962-9bb2-0d7e2b155e31", "value": "49152:eXe14sO2btdRmynOgGxntpQ9cm6Ki2nMq7y8cTJ0O8K0:eX042ZdRJi2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095699", "to_ids": false, "type": "size-in-bytes", "uuid": "5b2dcc98-847c-40bd-a7fe-ec89ad2631d2", "value": "2391552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "vhash", "timestamp": "1783095699", "to_ids": true, "type": "vhash", "uuid": "58c08939-dbcd-4aae-94ea-7bdab8a59455", "value": "126096551d151d151d051038z81hz23z11z4az1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:36:35+00:00", "last_seen": "2026-07-01T02:41:49+00:00", "object_relation": "filename", "timestamp": "1783095699", "to_ids": true, "type": "filename", "uuid": "9eb84dd1-6851-40d6-8843-f19242ee50a9", "value": "ctxmui.dll" } ] } ] } }