{
  "Event": {
    "analysis": "1",
    "date": "2026-06-16",
    "extends_uuid": "",
    "info": "[Threat Intel] Investigation of email-based attack delivering MediaFire ZIP file with execution chain analysis",
    "protected": false,
    "publish_timestamp": "1782253835",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782253834",
    "uuid": "be236a57-ec5e-4964-8305-33827a5a10fc",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#327a31",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Binary Padding - T1027.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#07a4a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665218",
        "to_ids": false,
        "type": "link",
        "uuid": "a689a1f8-f83f-4328-99e0-bddbeabf70ff",
        "value": "https://x.com/Kostastsale/status/2066545189137629302"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665218",
        "to_ids": false,
        "type": "text",
        "uuid": "78c2304d-508b-4414-b9ad-6001453d660c",
        "value": "An investigation revealed a malicious email campaign directing victims to download a ZIP file from MediaFire. The infection chain began with a Python setup executable (Setu.exe) that side-loaded a malicious 400 MB python37.dll containing repeated byte padding. The DLL performed process injection into dllhost.exe, establishing communication with a C2 server at 138.124.186.2:7000. The threat actor deployed three persistence mechanisms: a PowerShell-based path, a fake EdgeUpdate Python executable with scheduled task, and NetSupport RMM as a third access method. The analysis highlights the importance of comparing file timestamps during triage to identify malicious artifacts within compressed archives."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665218",
        "to_ids": false,
        "type": "text",
        "uuid": "91b5a2cf-2b5f-4e10-b1b3-8f1c254a72c4",
        "value": "Name: Investigation of email-based attack delivering MediaFire ZIP file with execution chain analysis\nAuthor: AlienVault\nAdversary: \nTags: [\"mediafire\", \"netsupport rmm\", \"dll hijacking\", \"scheduled task persistence\", \"remote access\", \"email delivery\", \"python side-loading\", \"process injection\"]\nTgtd countries: []\nMlwr families: [\"NetSupport RMM\"]\nAttack_ids: [\"T1053.005\", \"T1218.011\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1055\", \"T1027.001\", \"T1059.001\", \"T1547.001\", \"T1095\", \"T1132\", \"T1071.001\", \"T1574.002\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236152",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f6fcbb5e-691b-448a-8e8f-82f11a5a87d5",
        "value": "138.124.186.2",
        "Tag": [
          {
            "colour": "#b8cc18",
            "local": false,
            "name": "asn:asn=\"215540\"",
            "relationship_type": ""
          },
          {
            "colour": "#c38d7e",
            "local": false,
            "name": "asn:as-owner=\"GCS-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "060090f8-a582-4006-b8f8-98343295aaa4",
        "value": "bsc.blockrazor.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236197",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1bca3383-a4da-4841-bf05-e5009e46f508",
        "value": "xn--fiqq24b9hejs1c.clickvector.tech",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236220",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2fbc066f-f876-44c4-8044-6133b4a8a031",
        "value": "185.76.243.85",
        "Tag": [
          {
            "colour": "#b8cc18",
            "local": false,
            "name": "asn:asn=\"215540\"",
            "relationship_type": ""
          },
          {
            "colour": "#c38d7e",
            "local": false,
            "name": "asn:as-owner=\"GCS-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236244",
        "to_ids": true,
        "type": "url",
        "uuid": "ac348a31-71b9-4e18-848a-35974fcba379",
        "value": "https://pub-2f1bcdf12a2e44408e7a58efe6006d43.r2.dev/LICENSES.chromium.dat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236265",
        "to_ids": true,
        "type": "hostname",
        "uuid": "551c8a16-4015-4df4-a990-0a4d575ed22d",
        "value": "pub-2f1bcdf12a2e44408e7a58efe6006d43.r2.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782236287",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0267a9f9-3be1-474a-9752-0426175108e1",
        "value": "mgo.gstats-api-contact.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 7000",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782230658",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "7461fadc-e2c9-4e38-8edd-8a1e086f968f",
        "value": "138.124.186.2|7000"
      },
      {
        "category": "Network activity",
        "comment": "On port 443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782230658",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "bbad1435-4f0b-4eef-93fb-babbdbd57207",
        "value": "185.76.243.85|443"
      }
    ]
  }
}