{ "Event": { "analysis": "1", "date": "2026-07-16", "extends_uuid": "", "info": "[Threat Intel] Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident", "protected": false, "publish_timestamp": "1784560917", "published": true, "threat_level_id": "2", "timestamp": "1784560917", "uuid": "be3a3bb5-8aff-4f79-8c66-63628c7bd934", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#3000b9", "local": false, "name": "rectifyq:workflow=\"enrichment\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#c295b4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#3eba4a", "local": false, "name": "ioc>1k", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#18005e", "local": false, "name": "rectifyq:topic=\"supply-chain\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"BaoLoader\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"rhysida\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Ghost RAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"FIN6\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Gh0st Rat\"", "relationship_type": "" }, { "colour": "#3600cf", "local": false, "name": "rectifyq:detection-rules=\"snort-from-src\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784199619", "to_ids": false, "type": "link", "uuid": "08894f91-d544-450b-99fc-9a6d6846a659", "value": "https://expel.com/blog/introducing-cylindricalcanine/", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784199619", "to_ids": false, "type": "text", "uuid": "188cb885-244a-420a-bc46-1bc07a7c7557", "value": "Chinese cybercrime group GoldenEyeDog has been active since 2015, regularly updating malware and leveraging code-signing certificates to bypass Windows SmartScreen since 2024. A subgroup called CylindricalCanine uses Golden Gh0st Loader and Golden Gh0st RAT, modified versions of the 2008 Gh0st RAT, primarily targeting finance organizations in the Asia Pacific region through phishing campaigns. In April 2026, these actors compromised a DigiCert support member's device and stole code-signing certificates intended for customers, which they used to sign their own malware. The malware uses DLL sideloading, custom WebSocket protocols for command and control, and includes capabilities for remote access, credential theft, keylogging, SOCKS proxy tunneling, and RDP backdoor creation. Analysis reveals consistent tactics including using legitimate executables to load malicious DLLs that decrypt payloads from files disguised as logs." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784199619", "to_ids": false, "type": "text", "uuid": "ac36ec9f-667a-40dd-b6e7-d659ed280ca8", "value": "Name: Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident\nAuthor: AlienVault\nAdversary: CylindricalCanine\nTags: [\"golden gh0st loader\", \"cylindricalcanine\", \"goldeneyedog\", \"gh0st rat\", \"golden gh0st rat\"]\nTgtd countries: []\nMlwr families: [\"Golden Gh0st Loader\", \"Golden Gh0st RAT\", \"gh0st RAT - S0032\", \"Mydoor\", \"Moudoor\", \"Zhong Stealer\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1056.001\", \"T1539\", \"T1036.005\", \"T1087.002\", \"T1204.002\", \"T1573.001\", \"T1566.002\", \"T1566.001\", \"T1140\", \"T1055\", \"T1555.003\", \"T1070.001\", \"T1547.001\", \"T1059.003\", \"T1027.002\", \"T1071.001\", \"T1574.002\", \"T1021.001\", \"T1090.001\"]\nIndustries: [\"Finance\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784199619", "to_ids": false, "type": "threat-actor", "uuid": "1123b5f6-b768-49d1-975b-2f5b042c1104", "value": "CylindricalCanine" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784560322", "to_ids": true, "type": "url", "uuid": "88f98975-a779-4eb7-9257-4b0631446e00", "value": "http://uu.goldeyeuu.io:5188", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784560343", "to_ids": true, "type": "url", "uuid": "6efea6fc-6221-4048-91d1-afa308aacb36", "value": "http://api.keensie.com:5198", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557450", "to_ids": true, "type": "md5", "uuid": "48245fbf-c882-45ff-a124-b4283a6143e6", "value": "54def291b6bd573186734895b7ed03b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557452", "to_ids": true, "type": "sha256", "uuid": "b7a1d703-3ec3-4eb3-b2d2-3e8a9ef74c33", "value": "2031a71c399563adaf1572e10abb395387eb132208a001c5e140496d7a3e0b26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557453", "to_ids": true, "type": "sha256", "uuid": "1c2463cd-a593-4a95-9e60-2fd87c502b4e", "value": "8a913610e905c3dd1f657811ea3b1933471b230f88e1c155616099a03ab0abc0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784560364", "to_ids": true, "type": "url", "uuid": "0aabb1c8-e02d-4cdb-b51a-777b1c81be6c", "value": "http://wk.goldeyeuu.io:5188", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784468068", "to_ids": false, "type": "threat-actor", "uuid": "915505fb-e1a8-43f6-bd5f-aa6f214ae6b7", "value": "Expel-TA-0002" }, { "category": "Network activity", "comment": "On port 5188", "deleted": false, "disable_correlation": false, "timestamp": "1784560385", "to_ids": true, "type": "hostname", "uuid": "dc290f85-5792-4cb5-9b59-80f3ceb6db68", "value": "uu.goldeyeuu.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 5188", "deleted": false, "disable_correlation": false, "timestamp": "1784560407", "to_ids": true, "type": "hostname", "uuid": "230f99cc-1c0d-451e-b7e6-8b2bdb804708", "value": "wk.goldeyeuu.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 5198", "deleted": false, "disable_correlation": false, "timestamp": "1784560428", "to_ids": true, "type": "hostname", "uuid": "5a96a605-bb4b-4480-8acf-ee34d339a62d", "value": "api.keensie.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784468104", "to_ids": false, "type": "suricata", "uuid": "f04bda10-01c5-4d03-ad43-18da5262325c", "value": "alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\u201dET MALWARE GoldenGh0stLoader Directory Listing Command From C2\u2033; flow:established,to_client; content:\u201d|00 00 00 00 00 00 38 15 00 00|\u201d; fast_pattern; offset:4; byte_jump:2,2,from_beginning,little,post_offset 1; isdataat:!2,relative; classtype:trojan-activity; sid:1; rev:1;)" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784468104", "to_ids": false, "type": "suricata", "uuid": "61ef77d4-2207-47fe-b69f-a065c40e59e7", "value": "alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\u201dET MALWARE GoldenGh0stLoader Websocket Checkin \u2013 C2 Response\u201d; flow:established,to_client; content:\u201d|00 00 00 00 00 00 8b 0c|\u201d; fast_pattern; offset:4; byte_jump:2,2,from_beginning,little,post_offset 1; isdataat:!2,relative; classtype:trojan-activity; sid:1; rev:1;)" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784468207", "to_ids": false, "type": "link", "uuid": "541dcbd9-65d6-4be6-a92e-f36c79dd91da", "value": "https://github.com/expel-io/expel-intel/blob/main/2026/07/GoldenEyeDog-IOC/Golden_Gh0st_IOCs.csv" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560449", "uuid": "5afa16de-d7d0-4114-8201-ec0f62c4de8d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "md5", "timestamp": "1784560449", "to_ids": true, "type": "md5", "uuid": "b0c2c114-99e9-494e-b6fd-308c33cc13a4", "value": "31511d00c59e9cd8698bfb6996bb2f58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "sha1", "timestamp": "1784557315", "to_ids": true, "type": "sha1", "uuid": "069711e8-6a79-47b0-8a17-c914b6f8f2a0", "value": "8e44e73098104aaf86e7daf9f0034715f55a9ae5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "sha256", "timestamp": "1784557315", "to_ids": true, "type": "sha256", "uuid": "d5efe294-ef1f-426e-a108-2a44440c2f33", "value": "1abffe97aafe9916b366da57458a78338598cab9742c2d9e03e4ad0ba11f29bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "text", "timestamp": "1784554596", "to_ids": false, "type": "text", "uuid": "a3140254-19e2-40a2-b3f2-07cb487853b7", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 04:28 PM 12/20/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Malgent!MSR\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2024-12-20T20:03:07+00:00\nLast Submission: 2024-12-23T21:49:03+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "creation-time", "timestamp": "1784554596", "to_ids": false, "type": "datetime", "uuid": "29dd50a7-f77c-40f2-8f29-d18d8507cbbb", "value": "2024-12-20T08:24:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "ssdeep", "timestamp": "1784554596", "to_ids": true, "type": "ssdeep", "uuid": "534d1ab1-d601-40ec-968b-d694a636e3d2", "value": "3072:VgOTzki32ATVhxdFWP0imHwyhFRajWs6S2Q9DFsCHdXESC9h04VbUV/ytQORtQOP:VgOTDLLrI76S2kDeGXEEy7Bb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554596", "to_ids": false, "type": "size-in-bytes", "uuid": "082a02d7-80d7-45a3-8317-174d97f5a0c9", "value": "335424" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "vhash", "timestamp": "1784554596", "to_ids": true, "type": "vhash", "uuid": "e6ad0826-015f-41c7-a560-828087d49ed5", "value": "135066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T20:03:07+00:00", "last_seen": "2024-12-23T21:49:03+00:00", "object_relation": "filename", "timestamp": "1784554596", "to_ids": true, "type": "filename", "uuid": "3a30c38c-6ec0-4748-84b7-019e48096c55", "value": "TASLoginBase.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560470", "uuid": "83dd00ed-0a8f-4705-b949-57984731891f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "md5", "timestamp": "1784560470", "to_ids": true, "type": "md5", "uuid": "90166a7d-3e6e-4edb-99f6-b538dbfea5b9", "value": "e68d28be26e3e32d217f2ecaf9084fc7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "sha1", "timestamp": "1784557317", "to_ids": true, "type": "sha1", "uuid": "d3753adb-715d-473e-931f-f8601d1ff999", "value": "91f86d6b93510c58f1cc51bee5d808218da96750", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "sha256", "timestamp": "1784557317", "to_ids": true, "type": "sha256", "uuid": "0ca7932d-a69c-4c20-a8aa-d1ecfb69cf63", "value": "4eaebd93e23be3427d4c1349d64bef4b5fc455c93aebb9b5b752981e9266488e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "text", "timestamp": "1784554618", "to_ids": false, "type": "text", "uuid": "2674166e-1758-47f4-834c-328249ae0a0d", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 01:57 PM 09/03/2024\nSigners: Tencent Technology (Shenzhen) Company Limited; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: Trojan:Win32/Malgent!MSR\nClamAV: None\nVT Total Detection: 18/74\nFirst Seen In The Wild: 2024-09-17T03:21:51+00:00\nFirst Submission: 2024-09-15T15:31:45+00:00\nLast Submission: 2026-06-27T20:40:48+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "creation-time", "timestamp": "1784554618", "to_ids": false, "type": "datetime", "uuid": "f40cab67-722a-47df-8a40-a8d1f4c3c5bd", "value": "2024-09-03T13:49:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "ssdeep", "timestamp": "1784554618", "to_ids": true, "type": "ssdeep", "uuid": "d455077e-5c5c-4f20-8477-2f029358e064", "value": "24576:KiRQN8SJEi8WlrL/tlbdpwtWvig7cPchNxqswI:d+J98GjUWPAPchDNF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554618", "to_ids": false, "type": "size-in-bytes", "uuid": "a477a6ad-9a7a-4bdc-9b06-f17f13d164ce", "value": "996088" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "vhash", "timestamp": "1784554618", "to_ids": true, "type": "vhash", "uuid": "76613ee7-e5c7-414c-aa03-c160e1fd414d", "value": "095076757d1516757e7\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-15T15:31:45+00:00", "last_seen": "2026-06-27T20:40:48+00:00", "object_relation": "filename", "timestamp": "1784554618", "to_ids": true, "type": "filename", "uuid": "4ab3fd86-2859-4d51-9908-2a09f4343806", "value": "TASLogin" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560492", "uuid": "ba6d8415-d85f-4375-a553-92b92b05ab11", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "md5", "timestamp": "1784560492", "to_ids": true, "type": "md5", "uuid": "3c70836b-3c66-4f09-8a7d-9253c98f6c6c", "value": "fd4afc309bdf49a4784b8c4cdcd82229", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "sha1", "timestamp": "1784557318", "to_ids": true, "type": "sha1", "uuid": "9ec747c8-fb9e-419d-bbf6-3a6838c20ab3", "value": "b2b6a99eb0fd6da8e49fa186dc280f0463918642", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "sha256", "timestamp": "1784557318", "to_ids": true, "type": "sha256", "uuid": "9ec6508b-ec42-409b-96e6-8547ba777c5c", "value": "dd44dabff536a1aa9b845dd891ad483162d4f28913344c93e5d59f648a186098", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "text", "timestamp": "1784554640", "to_ids": false, "type": "text", "uuid": "d9a62641-4bd4-421a-beb6-09f40ddbd83c", "value": "Type Description: unknown\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2024-12-08T02:57:52+00:00\nLast Submission: 2024-12-20T20:03:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "ssdeep", "timestamp": "1784554640", "to_ids": true, "type": "ssdeep", "uuid": "8be0e11c-fc73-49b5-b4e2-cc96f5f3ff03", "value": "49152:C5YPkxRVDeSfrvkYBO6R0TagpAO4j8z0SzMHVJJMlit3:CfnDpnO6R2qO34HVsil" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554640", "to_ids": false, "type": "size-in-bytes", "uuid": "aafb4d93-1a1c-4abe-936e-bbca4152d156", "value": "2216351" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-08T02:57:52+00:00", "last_seen": "2024-12-20T20:03:11+00:00", "object_relation": "filename", "timestamp": "1784554640", "to_ids": true, "type": "filename", "uuid": "894377a6-2428-40e8-8410-af8fa2d101dc", "value": "TASLogin.log" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560513", "uuid": "d4f996ae-9b11-4c0d-a9c2-a17f4be892f8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "md5", "timestamp": "1784560513", "to_ids": true, "type": "md5", "uuid": "07f0fdcf-51ef-49cf-881b-0af54929870f", "value": "639b0dd0fe4da3f4743de6347d7d58b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "sha1", "timestamp": "1784557319", "to_ids": true, "type": "sha1", "uuid": "4066009a-b948-46e7-be82-6ca4be9e11c5", "value": "f04ccc9a18dc71ccc4d4b1f651d3d0d2af8ab402", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "sha256", "timestamp": "1784557319", "to_ids": true, "type": "sha256", "uuid": "72bf39df-bd86-49c6-9c6f-a8938724dee5", "value": "27b722c66f69e360c4da106daacf3b9eeaabd20634d7e5eff45a28bd70ebfd65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "text", "timestamp": "1784554683", "to_ids": false, "type": "text", "uuid": "71e328e2-e9f1-48ee-b032-3ccc46d40c17", "value": "Type Description: Win32 DLL\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 08:19 PM 05/26/2026\nSigners: LENOVO (UNITED STATES) INC.; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: Trojan:Win32/DLLHijack.DA!MTB\nClamAV: None\nVT Total Detection: 37/74\nFirst Submission: 2026-05-27T18:24:37+00:00\nLast Submission: 2026-05-27T18:24:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "creation-time", "timestamp": "1784554683", "to_ids": false, "type": "datetime", "uuid": "2024ea1f-528e-46af-b991-f2d3f9799cf0", "value": "2026-05-26T20:17:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "ssdeep", "timestamp": "1784554683", "to_ids": true, "type": "ssdeep", "uuid": "3d5ce2f0-36ef-4b79-a046-3f9e28807d58", "value": "3072:74xKlcUkPlMw7f3Ga5jSweXTKcQKZm4l6:74XUktLb4XxQKZx6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554683", "to_ids": false, "type": "size-in-bytes", "uuid": "6e6d1130-c83a-403d-be9e-d545bb6ac594", "value": "107432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "vhash", "timestamp": "1784554683", "to_ids": true, "type": "vhash", "uuid": "aff711a4-eefb-4edf-a077-c4e2074a6dfd", "value": "115066655d1d05156az42?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T18:24:37+00:00", "last_seen": "2026-05-27T18:24:37+00:00", "object_relation": "filename", "timestamp": "1784554683", "to_ids": true, "type": "filename", "uuid": "fe58a38a-08a8-4453-b0f4-5d343396d1e2", "value": "crashreport.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560534", "uuid": "75674090-bb52-4076-9c1a-c63dd57d889f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "md5", "timestamp": "1784560534", "to_ids": true, "type": "md5", "uuid": "899a54a3-75bc-4790-9076-18fdf376e3aa", "value": "efe7a351491008a2ccb6b5d586904aba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "sha1", "timestamp": "1784557320", "to_ids": true, "type": "sha1", "uuid": "14410ace-f3b6-4444-8f97-2a7ffa0a1db8", "value": "f1888d0b44e5e1d5864ca5a9e93bf65c09411320", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "sha256", "timestamp": "1784557320", "to_ids": true, "type": "sha256", "uuid": "c5b15692-16da-458b-b951-7f8d990481b2", "value": "f67de637fca127212dc60b9a02f74e66dbd602b3b9f6f6e4f2b75614c1f9e944", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "text", "timestamp": "1784554704", "to_ids": false, "type": "text", "uuid": "4548f335-6449-47d5-88fc-ad7ae6e011ec", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-28T23:48:47+00:00\nLast Submission: 2026-05-28T23:48:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "ssdeep", "timestamp": "1784554704", "to_ids": true, "type": "ssdeep", "uuid": "60a986fe-f7c0-4f73-8d9b-8be987e0ccae", "value": "192:6HHLkPKYdbSW4KWEyG1bUDHGLr44GvCxLG5WPYYG+nYx/pAlw0fcm:subgKWXSbUD0JGvWLaV+YxSwk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554704", "to_ids": false, "type": "size-in-bytes", "uuid": "a420723e-ddcc-498b-8736-c016aa86e427", "value": "13830" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "vhash", "timestamp": "1784554705", "to_ids": true, "type": "vhash", "uuid": "43cf9525-f6f8-452b-ad27-d7a96fbbe5b3", "value": "920543dc09795728d829e7e1336e56c75" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T23:48:47+00:00", "last_seen": "2026-05-28T23:48:47+00:00", "object_relation": "filename", "timestamp": "1784554705", "to_ids": true, "type": "filename", "uuid": "6b67e326-899b-4636-929a-002830ce6ae5", "value": "temp_image.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560555", "uuid": "762cc28a-938f-4fad-bcc3-5ba7a324de30", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "md5", "timestamp": "1784560555", "to_ids": true, "type": "md5", "uuid": "3ec6df27-0e4d-4573-bfd9-9cbae53b2f8d", "value": "c8070fcb74c230f4e9ba023cacc6cfd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "sha1", "timestamp": "1784557321", "to_ids": true, "type": "sha1", "uuid": "b75d2a14-6835-4c63-9651-ab1f4c80e199", "value": "b0dab810409dd23929864a5ce92f77d27ac9225c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "sha256", "timestamp": "1784557322", "to_ids": true, "type": "sha256", "uuid": "a0829e23-73b7-404e-9027-556fc1dcf214", "value": "2b0071007c3f5fa8e949a8de53be03e97901dd505694ca939b575a49e4fdbdbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "text", "timestamp": "1784554747", "to_ids": false, "type": "text", "uuid": "0b27a165-85fc-4f0a-8610-fd3403fec1a6", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 12:23 PM 03/19/2026\nSigners: Guangzhou Jinhong Network Media Co,Ltd.; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-04-07T14:39:37+00:00\nLast Submission: 2026-05-29T11:26:12+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "creation-time", "timestamp": "1784554747", "to_ids": false, "type": "datetime", "uuid": "a490d325-d04b-4b27-a8e0-cefc7042fd3a", "value": "2026-03-19T12:22:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "ssdeep", "timestamp": "1784554747", "to_ids": true, "type": "ssdeep", "uuid": "8e1f7273-1444-4f51-9c2d-3af2aece5529", "value": "1536:4aKpo1Hu7HUh+xSU6loujrErftXlsUOkg9+2n90e7YDvQ1:sCixwrEbhZOkg9dn95CvQ1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554747", "to_ids": false, "type": "size-in-bytes", "uuid": "22d75f04-0949-4b91-aad1-b2bb575897b5", "value": "100200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "vhash", "timestamp": "1784554747", "to_ids": true, "type": "vhash", "uuid": "5c184fbd-c81f-4091-b43c-dcd0a97232fe", "value": "015056655d15756038z29hz301bz34z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:39:37+00:00", "last_seen": "2026-05-29T11:26:12+00:00", "object_relation": "filename", "timestamp": "1784554747", "to_ids": true, "type": "filename", "uuid": "4bef1170-f122-4859-843f-8fb2582260d4", "value": "yyexternal.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560576", "uuid": "895879a9-718e-4210-9ae8-b62f03b9f453", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "md5", "timestamp": "1784560576", "to_ids": true, "type": "md5", "uuid": "2017c1b5-dd80-4598-b393-96f0f32eef43", "value": "cfc4f106d5e4e143c42078deb8f3c5b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "sha1", "timestamp": "1784557323", "to_ids": true, "type": "sha1", "uuid": "c931fc46-72e9-48ad-a1b1-134bd0384bd5", "value": "a24a4dc68b525a0ae007c7d4717f5d73c22d3b13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "sha256", "timestamp": "1784557323", "to_ids": true, "type": "sha256", "uuid": "62a2269f-7fb5-46db-a1a5-4cf76a6d51c7", "value": "3313f347e83aaf48ea31fb1d49fc37452f48f81d20a1b93009e2e78385ff4bba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "text", "timestamp": "1784554769", "to_ids": false, "type": "text", "uuid": "04616803-cd80-44a7-b445-3cf83710813a", "value": "Type Description: unknown\nMicrosoft: None\nClamAV: None\nVT Total Detection: 7/74\nFirst Submission: 2026-04-20T12:58:08+00:00\nLast Submission: 2026-05-28T09:15:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "ssdeep", "timestamp": "1784554769", "to_ids": true, "type": "ssdeep", "uuid": "77512cb5-d684-442f-8412-f3ab748f76bc", "value": "3072:pYFDJkQh6kGDl4uRLsD+3EA1DSrA558dAygUQ4CxGAyjPuK:SDGZl4uR+Ur1OrRu2RCxTyjPd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554769", "to_ids": false, "type": "size-in-bytes", "uuid": "6c4907e5-851a-4054-a6a0-ccf8905fb90c", "value": "162744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T12:58:08+00:00", "last_seen": "2026-05-28T09:15:54+00:00", "object_relation": "filename", "timestamp": "1784554769", "to_ids": true, "type": "filename", "uuid": "410680c9-86fa-489b-8b34-eb2a32dcc4a2", "value": "NvBackend.log" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560598", "uuid": "80885ca8-80ec-41ef-ba12-4c1af364ffd8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "md5", "timestamp": "1784560598", "to_ids": true, "type": "md5", "uuid": "a34558c7-dd1f-4a87-ba0f-9ade2d0413fc", "value": "1ec6831e419c8a46809638786eb06ebe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "sha1", "timestamp": "1784557324", "to_ids": true, "type": "sha1", "uuid": "d648da70-ea25-487a-b070-d3c8eaa1e7fa", "value": "602fb9f2e28527b5c976a02f0064d08c27226ab2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "sha256", "timestamp": "1784557324", "to_ids": true, "type": "sha256", "uuid": "4d28bb92-4d4f-416a-80d6-4598240f3ba7", "value": "81e276aaa3eb9b3f595663c316b3c6414cc3dde5e6cc3a82856b7276acabb7de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "text", "timestamp": "1784554791", "to_ids": false, "type": "text", "uuid": "f36d5dc0-89c5-4a21-a7e4-8ad2363ea364", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 54/74\nFirst Submission: 2024-10-10T04:36:29+00:00\nLast Submission: 2024-10-10T04:37:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "creation-time", "timestamp": "1784554791", "to_ids": false, "type": "datetime", "uuid": "1fcb2e31-e6f6-422e-b3cd-f0b165d43fbd", "value": "2023-07-06T14:32:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "ssdeep", "timestamp": "1784554791", "to_ids": true, "type": "ssdeep", "uuid": "e3f180ac-50a6-4e43-98b1-c185651c8b52", "value": "6144:STPqAJ7qP+1Gzt+N0SYHXHWnTCRPwoyYP4TBHYXJ3d1ut:wqxP3tGY3HWnTCRP2YQTFYX4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554791", "to_ids": false, "type": "size-in-bytes", "uuid": "c96a0d3f-0d12-44c9-bde6-67e53f5449d6", "value": "340992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "vhash", "timestamp": "1784554791", "to_ids": true, "type": "vhash", "uuid": "6d38e6dc-c8a6-4fdb-b7aa-8cdd8d29ed41", "value": "135056655d155561e8z927z404013z6021zd1z3001e7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-10T04:36:29+00:00", "last_seen": "2024-10-10T04:37:20+00:00", "object_relation": "filename", "timestamp": "1784554791", "to_ids": true, "type": "filename", "uuid": "5d80b703-a4ed-4564-8767-7a49cf8a1758", "value": "payload.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560619", "uuid": "74526bdb-0473-4404-bf60-e9f1059c72ec", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "md5", "timestamp": "1784560619", "to_ids": true, "type": "md5", "uuid": "97bd3d58-17c6-4f7e-85dd-3477229f971b", "value": "9a5624d9103cdca02ff33a05fda124cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "sha1", "timestamp": "1784557326", "to_ids": true, "type": "sha1", "uuid": "26eb5b68-af77-45f0-af6a-460af9561d9e", "value": "6782fcab3360182cc23603e0d95239e6902eea6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "sha256", "timestamp": "1784557326", "to_ids": true, "type": "sha256", "uuid": "43fe7f26-d626-494e-992f-6a78335493e0", "value": "d1b1938963037aa332591a4c999523a05886d1f62d80e03f0adc22630b8671c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "text", "timestamp": "1784554833", "to_ids": false, "type": "text", "uuid": "03f407c9-19bf-498c-b3a6-c15a30e39216", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:MSIL/Tinuke.GA!MTB\nClamAV: Win.Dropper.Gh0stRAT-9856137-0\nVT Total Detection: 29/74\nFirst Submission: 2026-07-15T13:02:23+00:00\nLast Submission: 2026-07-15T13:02:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "creation-time", "timestamp": "1784554833", "to_ids": false, "type": "datetime", "uuid": "629aba8e-da98-4f79-84ca-3a23f0899901", "value": "2022-09-25T08:41:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "ssdeep", "timestamp": "1784554833", "to_ids": true, "type": "ssdeep", "uuid": "4d7b3147-ac93-4a5b-8b8a-1f8659143735", "value": "6144:GGveWediC4K25p0MjX3OqM9p4aa9K5hv8G4TCeFhzHSzMAvATBD+1e3vi:SMC4Kkp0Mb3kr4l9eZmfFhbSAAvATek" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554833", "to_ids": false, "type": "size-in-bytes", "uuid": "24a561ef-7306-4f72-ad93-d515059eab86", "value": "349696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "vhash", "timestamp": "1784554833", "to_ids": true, "type": "vhash", "uuid": "674558fe-39c2-4324-8e5d-8335dc68f711", "value": "135056655d55155145zc009d1z87z23z50200363z12b6zb" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T13:02:23+00:00", "last_seen": "2026-07-15T13:02:23+00:00", "object_relation": "filename", "timestamp": "1784554833", "to_ids": true, "type": "filename", "uuid": "51723c5f-3b34-4691-bb8d-a20208b0acd6", "value": "plugin32_assembled_unpacked.bin" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560640", "uuid": "1860ed9e-0807-476b-a210-47a7661aa630", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "md5", "timestamp": "1784560640", "to_ids": true, "type": "md5", "uuid": "517b18da-b67b-4e38-8e1b-e2cf64a8f6cb", "value": "9a90bd1f3d5e7350875904362063841d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "sha1", "timestamp": "1784557327", "to_ids": true, "type": "sha1", "uuid": "7d9d7e90-f4aa-4c42-820b-a22ca1a0edb8", "value": "5fb7a301b8724ccedd7983d91646f5d4ee683dc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "sha256", "timestamp": "1784557327", "to_ids": true, "type": "sha256", "uuid": "672071f1-78bf-4a1c-8854-f737b8a59af1", "value": "f548cdeee5c84e00faee1ea3195be8ede0b64dc00cc33280578014b09ee3bcd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "text", "timestamp": "1784554854", "to_ids": false, "type": "text", "uuid": "33c03169-6b9d-4536-9d81-08032f436625", "value": "Type Description: Win32 EXE\nVerified: A certificate was explicitly revoked by its issuer.\nSigners: BLOOMTECHNOLOGY.INC; Sectigo Public Code Signing CA R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)\nMicrosoft: Trojan:Win32/Nanocore!rfn\nClamAV: None\nVT Total Detection: 11/74\nFirst Submission: 2023-05-18T05:25:06+00:00\nLast Submission: 2025-04-23T20:04:15+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "creation-time", "timestamp": "1784554854", "to_ids": false, "type": "datetime", "uuid": "d0170bc0-7738-408a-a1fb-3b9b10cb4b29", "value": "2022-03-24T08:45:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "ssdeep", "timestamp": "1784554854", "to_ids": true, "type": "ssdeep", "uuid": "6369debf-f014-4123-b007-12d70ae01e89", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXda5ktWz:UPVt/LZeJbInQRa5L" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554854", "to_ids": false, "type": "size-in-bytes", "uuid": "d0df129e-bce9-4e4e-ae17-520cb316c0be", "value": "921304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "vhash", "timestamp": "1784554854", "to_ids": true, "type": "vhash", "uuid": "2d5c1075-06b4-47bb-af48-8ed70aba63e6", "value": "095056655d15556210b02002300a86z161d013zf2za0030e039z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-05-18T05:25:06+00:00", "last_seen": "2025-04-23T20:04:15+00:00", "object_relation": "filename", "timestamp": "1784554854", "to_ids": true, "type": "filename", "uuid": "fe044777-b86e-40a1-88fd-7109c7fa0e8e", "value": "p7fly768s.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560661", "uuid": "024f52c1-8561-43ea-aae7-6ade60f62c41", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "md5", "timestamp": "1784560661", "to_ids": true, "type": "md5", "uuid": "1a6967b8-7178-4895-bd5c-2482fe5bb7a2", "value": "92cff085a05ffa16af63eeab87292cfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "sha1", "timestamp": "1784557328", "to_ids": true, "type": "sha1", "uuid": "86cb5d19-e576-4e57-a628-6c8d40e77966", "value": "ffd06edf0f5c550f51ec00aa499e4ee0f771cf67", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "sha256", "timestamp": "1784557328", "to_ids": true, "type": "sha256", "uuid": "f0cb8c13-3cd2-4665-8339-a4b7457ac3d8", "value": "ab917cf806fc808f2beaa09d52ef93632501de1f604ce02c4cd7249960913a30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "text", "timestamp": "1784554876", "to_ids": false, "type": "text", "uuid": "60978503-4457-4a3f-8a22-6475e11bfffc", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 10:52 AM 01/09/2024\nSigners: Portier Global Pty Ltd; SSL.com EV Code Signing Intermediate CA RSA R3; SSL.com EV Root Certification Authority RSA R2\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2024-01-11T13:31:35+00:00\nLast Submission: 2024-01-11T13:31:35+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "creation-time", "timestamp": "1784554876", "to_ids": false, "type": "datetime", "uuid": "6b12a793-079e-4d6d-a9d1-4ae78052aa97", "value": "2023-07-02T02:09:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "ssdeep", "timestamp": "1784554876", "to_ids": true, "type": "ssdeep", "uuid": "85235b7f-5a17-4135-9983-b679324258ea", "value": "3145728:ICc3EHbzZ1Z7b46/HrtEgBihE3QbSQF38SiVid9AR8sqNT4NNmAK6IFRTfLXGVor:lc3EnZ77bBxF33C85VA2ANqmAK6oTjys" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554876", "to_ids": false, "type": "size-in-bytes", "uuid": "8b6364e1-e683-469b-b23c-4113b944f5ec", "value": "195027576" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "vhash", "timestamp": "1784554876", "to_ids": true, "type": "vhash", "uuid": "345db9c3-d285-4457-bddf-dacbf89a4883", "value": "018056655d1c0550c043z800417z57z52z4gz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-11T13:31:35+00:00", "last_seen": "2024-01-11T13:31:35+00:00", "object_relation": "filename", "timestamp": "1784554876", "to_ids": true, "type": "filename", "uuid": "1f1f173b-1fc8-46b1-82f8-073c1663e545", "value": "SetupPortierVision_4.11.0.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560682", "uuid": "1049147c-cf85-4acb-8c21-f2deca7dc86e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "md5", "timestamp": "1784560682", "to_ids": true, "type": "md5", "uuid": "d98eb2f9-a300-4542-bc88-97bcfc9b2a7b", "value": "54adf5555e181e878c83180a2151baa3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "sha1", "timestamp": "1784557330", "to_ids": true, "type": "sha1", "uuid": "7c27c579-56f5-4576-94a3-9067c0c9b532", "value": "b5eda1fe33e2fce1efa5abcb74fd41892bb5802c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "sha256", "timestamp": "1784557330", "to_ids": true, "type": "sha256", "uuid": "479d246e-07a9-4906-bdd3-c2cea651ce8f", "value": "d56f2b7e9bdb192171dc5e68bf1c5f06446c73f2f5b75e49eb00886849e480a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "text", "timestamp": "1784554898", "to_ids": false, "type": "text", "uuid": "d2492ea1-872b-4ebf-8168-f1345854705b", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 12:22 PM 04/21/2024\nSigners: GZ.PurestJone Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 16/74\nFirst Submission: 2024-04-26T11:58:38+00:00\nLast Submission: 2024-04-26T13:16:17+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "creation-time", "timestamp": "1784554898", "to_ids": false, "type": "datetime", "uuid": "5950fd17-ca2c-499c-ab70-95e38a8ee6ba", "value": "2018-12-15T22:26:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "ssdeep", "timestamp": "1784554898", "to_ids": true, "type": "ssdeep", "uuid": "6010cf0b-da49-4e25-9aae-ed594266372a", "value": "1572864:CvPkJopo3yf5kD/HuwbYFGNy13y7acQh90R+2LY35ql:Cv3poQGHuwbOGcy7acQh90R+QY0l" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554898", "to_ids": false, "type": "size-in-bytes", "uuid": "50b453cc-0d70-4c6c-b819-af283288865c", "value": "69421416" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "vhash", "timestamp": "1784554898", "to_ids": true, "type": "vhash", "uuid": "12b6949b-ce5b-49c4-af35-ec20d293ab47", "value": "067056655d1c0570d043z800417z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-26T11:58:38+00:00", "last_seen": "2024-04-26T13:16:17+00:00", "object_relation": "filename", "timestamp": "1784554898", "to_ids": true, "type": "filename", "uuid": "9e3b2504-02f4-4237-8d53-ce5839fb866f", "value": "Goheard Setup.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560704", "uuid": "58eb83ab-d145-4085-b721-9a16e4ae3458", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "md5", "timestamp": "1784560704", "to_ids": true, "type": "md5", "uuid": "1c1aa3b0-b85f-47c4-878c-40ee34dcef19", "value": "ce88042364195c44d6760e77fba8c3ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "sha1", "timestamp": "1784557331", "to_ids": true, "type": "sha1", "uuid": "caa29175-c7ef-4903-9534-f726927e88c3", "value": "06240a48ff3eeec6d2d30d3fb3d83170a139e3bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "sha256", "timestamp": "1784557331", "to_ids": true, "type": "sha256", "uuid": "f65cdc2a-e3a0-4031-ba4a-6918223a55b9", "value": "81b113143e51fe458001e6dd94b58ccaaa92accfed3144ec91b683c3f7a8c7df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "text", "timestamp": "1784554919", "to_ids": false, "type": "text", "uuid": "3305d3a4-c5eb-4339-ba66-0c41c72046cd", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 05:46 PM 06/25/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2024-07-03T11:08:26+00:00\nFirst Submission: 2024-06-26T22:51:45+00:00\nLast Submission: 2024-06-28T15:34:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "creation-time", "timestamp": "1784554919", "to_ids": false, "type": "datetime", "uuid": "bfa0b8c3-f383-4940-9db0-5966a28bc16f", "value": "2024-06-15T14:01:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "ssdeep", "timestamp": "1784554919", "to_ids": true, "type": "ssdeep", "uuid": "5856c962-6f13-42d7-87ba-37115f28dc53", "value": "1536:h6j91F8PErb7+17TmHoqQNl7RPE1T47OQf6U8eTFB/xC8tQo/NsxY:hWOErb7+1/m82NQf6U82BJBtQOV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554919", "to_ids": false, "type": "size-in-bytes", "uuid": "19d091ea-228a-47de-8540-4ead6d4b14f4", "value": "63912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "vhash", "timestamp": "1784554919", "to_ids": true, "type": "vhash", "uuid": "cdecfc94-6d22-463d-ad76-215739f9dd86", "value": "16403e0f7d1bz5?z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-26T22:51:45+00:00", "last_seen": "2024-06-28T15:34:45+00:00", "object_relation": "filename", "timestamp": "1784554919", "to_ids": true, "type": "filename", "uuid": "544cb4e2-db03-4136-a358-687b6436d949", "value": "TenioDL_core.dll_1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560725", "uuid": "25625ac0-bdaf-48e2-b2f6-64d086d4d91a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "md5", "timestamp": "1784560725", "to_ids": true, "type": "md5", "uuid": "9a8ed9c5-ba12-4465-bc92-9e57db6d3cff", "value": "adb292cf00b16af6fcdb3c5a10c275b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "sha1", "timestamp": "1784557332", "to_ids": true, "type": "sha1", "uuid": "b729e1d8-4b82-4f94-8de3-80c7c0e9a878", "value": "bdf4ab71f7262620e2a00a67b9d7cbee09c91544", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "sha256", "timestamp": "1784557332", "to_ids": true, "type": "sha256", "uuid": "50fd84b1-61cb-4253-839e-23baae1ac70a", "value": "e86943be5b1c00a2e28d60ecb246ec06cde946ff0713ee2774c65ccbb6499c25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "text", "timestamp": "1784554941", "to_ids": false, "type": "text", "uuid": "7c548d7e-7a40-4c55-ae71-cdd19217c70b", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 07:02 PM 06/29/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 33/74\nFirst Seen In The Wild: 2024-07-03T11:09:47+00:00\nFirst Submission: 2024-07-01T06:04:00+00:00\nLast Submission: 2024-07-01T06:04:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "creation-time", "timestamp": "1784554941", "to_ids": false, "type": "datetime", "uuid": "f7e89dfb-758e-4402-a80c-c9361951de5a", "value": "2023-07-31T11:51:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "ssdeep", "timestamp": "1784554941", "to_ids": true, "type": "ssdeep", "uuid": "ff3d63a4-4504-4b4f-bf03-2e562de93d7a", "value": "768:1aOrvgIIq70t7VwuVKhTYmnTEDf3vyKufENAMxb2gQ4R/lITrM2gQ4R/NC8AMxkV:1avIj0Yq2vZKlxbtQo/larMtQo/Npxo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554941", "to_ids": false, "type": "size-in-bytes", "uuid": "c6f03286-c22f-45ea-a93d-1b9403c131e3", "value": "55352" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-01T06:04:00+00:00", "last_seen": "2024-07-01T06:04:00+00:00", "object_relation": "vhash", "timestamp": "1784554941", "to_ids": true, "type": "vhash", "uuid": "3f6c1081-d5ea-47a2-bfad-f166a8870247", "value": "154056655d15555az3enz1ez3" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560746", "uuid": "79589406-3025-4f93-bcaf-3a38b73a61bc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "md5", "timestamp": "1784560746", "to_ids": true, "type": "md5", "uuid": "5218247e-7dd3-4b6c-b41b-0d59baf75671", "value": "c72926f7d5d7bc4f8f00af2a473c2bac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "sha1", "timestamp": "1784557333", "to_ids": true, "type": "sha1", "uuid": "a4bc16d0-f815-4eba-a068-0dbd977e5a6f", "value": "aad41c3305397cbe25fdedd6dc8d3a1d0334c307", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "sha256", "timestamp": "1784557333", "to_ids": true, "type": "sha256", "uuid": "c8a5304e-e2e8-4d42-b6e3-c6add5f54fef", "value": "746cd25d41bd556e7bb1ea7d9a2d896e5a523debb2cf14cfc97fa7c9157a8ce3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "text", "timestamp": "1784554962", "to_ids": false, "type": "text", "uuid": "a2162616-9f2f-4771-acb6-5d926ce32a61", "value": "Type Description: Win32 EXE\nOriginal nam%WINDIR%\\ormsApp3.exe\nVerified: Signed\nSigning date: 01:55 PM 07/02/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2024-07-03T10:20:09+00:00\nFirst Submission: 2024-07-03T02:11:32+00:00\nLast Submission: 2024-07-03T02:45:24+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "creation-time", "timestamp": "1784554962", "to_ids": false, "type": "datetime", "uuid": "cd13f672-7af5-441f-84fc-b3571da128e2", "value": "2098-04-16T14:16:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "ssdeep", "timestamp": "1784554962", "to_ids": true, "type": "ssdeep", "uuid": "8b831b59-4536-4c47-ac28-488d4edf1ac7", "value": "1536:Ljsc8jaNKRyGOK5gqg69iz7xbtQo/ldtQo/NzaxAPO:sc8jaKkGOKWqg6oz1tQOTtQOJO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554962", "to_ids": false, "type": "size-in-bytes", "uuid": "352b581b-0cd7-45cf-afd4-7cc9c672a8bd", "value": "54328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "vhash", "timestamp": "1784554962", "to_ids": true, "type": "vhash", "uuid": "cc8c7d28-58dc-4d95-a5e0-c85e06fe413c", "value": "254036755511b0856e1025" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-03T02:11:32+00:00", "last_seen": "2024-07-03T02:45:24+00:00", "object_relation": "filename", "timestamp": "1784554962", "to_ids": true, "type": "filename", "uuid": "2eafb316-cbde-46ba-a74d-51f3861d0793", "value": "WindowsFormsApp3.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560768", "uuid": "13b36d2d-e354-4fd5-99e5-742479c1ff8d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "md5", "timestamp": "1784560768", "to_ids": true, "type": "md5", "uuid": "9f245b9e-f370-4b80-a8f8-a1b2e7986845", "value": "19af6300a5a93d79516802b03380bff6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "sha1", "timestamp": "1784557334", "to_ids": true, "type": "sha1", "uuid": "91394d51-12ad-481f-babc-07a84e11c683", "value": "58df6094475400114c10da99e0dda9497003c6b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "sha256", "timestamp": "1784557334", "to_ids": true, "type": "sha256", "uuid": "89b0cf12-50a5-40c3-a6b5-ab7f6d111407", "value": "ff0defea1db8e01ed19e4569b748d2732de4a693df559ffc16ac13b148580127", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "text", "timestamp": "1784554984", "to_ids": false, "type": "text", "uuid": "c22f561e-cebf-4074-ae0e-f2ad6797ae76", "value": "Type Description: Win32 EXE\nOriginal nam%WINDIR%\\ormsApp3.exe\nVerified: Signed\nSigning date: 04:09 PM 07/03/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2024-07-05T03:56:30+00:00\nFirst Submission: 2024-07-05T01:56:09+00:00\nLast Submission: 2024-07-05T01:56:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "creation-time", "timestamp": "1784554984", "to_ids": false, "type": "datetime", "uuid": "e38b53b1-0304-4ba1-a4bf-7b2bcb5da739", "value": "2098-04-16T14:16:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "ssdeep", "timestamp": "1784554984", "to_ids": true, "type": "ssdeep", "uuid": "8a9de1c8-664a-4df8-8b17-96c23fbcefb8", "value": "1536:mjsc8jaNKRyGOK5gdC69iz5xbtQo/litQo/NHx:9c8jaKkGOKWdC6ozjtQOAtQO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554984", "to_ids": false, "type": "size-in-bytes", "uuid": "1bee171d-2756-4605-876d-b3d5f42600c3", "value": "55864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "vhash", "timestamp": "1784554984", "to_ids": true, "type": "vhash", "uuid": "ce52b13e-3c32-455e-a571-129adaeb16a6", "value": "254036755511b0856e1025" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-05T01:56:09+00:00", "last_seen": "2024-07-05T01:56:09+00:00", "object_relation": "filename", "timestamp": "1784554984", "to_ids": true, "type": "filename", "uuid": "0492f114-e66d-4b4a-8f12-e2b19391388a", "value": "WindowsFormsApp3.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560789", "uuid": "a7208deb-a290-4922-8f81-a87a7451e187", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "md5", "timestamp": "1784560789", "to_ids": true, "type": "md5", "uuid": "79912062-d04f-4996-badb-126999863f49", "value": "25deeefe0ce2a3ac485a544291b1493a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "sha1", "timestamp": "1784557335", "to_ids": true, "type": "sha1", "uuid": "9079efab-3498-42bd-a82c-4c4927ee475a", "value": "dc7e68c0449583444aaf6ac91b473f13c5bf3068", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "sha256", "timestamp": "1784557335", "to_ids": true, "type": "sha256", "uuid": "19a4abf9-d37f-44ba-8511-8f47be891a09", "value": "733f14804c82acbf657120d75b149525d8b71c28a65c79133dedf0dc13f7b41e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "text", "timestamp": "1784555005", "to_ids": false, "type": "text", "uuid": "88c3cc95-b2d2-4441-9831-87ba63090ed4", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 06:58 AM 07/07/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2024-07-08T03:24:33+00:00\nFirst Submission: 2024-07-10T08:10:22+00:00\nLast Submission: 2024-07-13T12:41:26+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "creation-time", "timestamp": "1784555005", "to_ids": false, "type": "datetime", "uuid": "124b92b1-ced1-4218-ac57-359a0b85515a", "value": "2024-07-07T06:40:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "ssdeep", "timestamp": "1784555005", "to_ids": true, "type": "ssdeep", "uuid": "1e0a1c1c-c998-4d74-8e32-8c6118be5754", "value": "1536:tAhQ7ka1WSRPGWUaR+D1A+bisdb/ZTxbtQo/V5tQo/5iIxF:tAhQ7fRLUnBAwTdtQOrtQOX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555005", "to_ids": false, "type": "size-in-bytes", "uuid": "92ed0a9e-7252-41d3-a7ea-af1a1dd4e1a8", "value": "70192" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "vhash", "timestamp": "1784555005", "to_ids": true, "type": "vhash", "uuid": "ff0eefd4-2a48-422b-a4cd-a9cb1d768577", "value": "17403e0f7d1bz5?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T08:10:22+00:00", "last_seen": "2024-07-13T12:41:26+00:00", "object_relation": "filename", "timestamp": "1784555005", "to_ids": true, "type": "filename", "uuid": "3da0983c-1e36-4a45-a34a-95d15af417e8", "value": "733f14804c82acbf657120d75b149525d8b71c28a65c79133dedf0dc13f7b41e.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560810", "uuid": "ff8fd9d4-f87c-4bc7-88cd-4926d3c44b4f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "md5", "timestamp": "1784560810", "to_ids": true, "type": "md5", "uuid": "0f2caae4-7017-4adb-b038-88382e5bb2dd", "value": "759326438fa3ad252603e55c46da015e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "sha1", "timestamp": "1784557337", "to_ids": true, "type": "sha1", "uuid": "56eae643-2a9c-454f-ab05-e074eb41385d", "value": "662e868a733c1dabe4024f250a37f34e9de49c5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "sha256", "timestamp": "1784557337", "to_ids": true, "type": "sha256", "uuid": "d49d15df-91e3-4019-b1fd-089fc570f427", "value": "a60be721f15ff25e189de6171ac01fd23f99ea0fd5ab8af02b49b779a2835667", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "text", "timestamp": "1784555027", "to_ids": false, "type": "text", "uuid": "82a216f7-1ba3-4348-ba3b-65e8b2fdb6fa", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: Win.Trojan.Generic-10040693-0\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2024-07-11T21:20:03+00:00\nFirst Submission: 2024-07-10T11:17:27+00:00\nLast Submission: 2024-07-10T11:17:27+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "creation-time", "timestamp": "1784555027", "to_ids": false, "type": "datetime", "uuid": "8591c301-3954-4eb8-87bf-420f6b1e9019", "value": "2024-07-07T06:40:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "ssdeep", "timestamp": "1784555027", "to_ids": true, "type": "ssdeep", "uuid": "4d5381b8-ada7-411a-9681-9012ee6695d9", "value": "3072:oR9LipcSuc23C/vdu1Jl5zOAav5tQOrtQOX:oRCcx3CdIOAav5xp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555027", "to_ids": false, "type": "size-in-bytes", "uuid": "2a4021b9-b7e5-475c-82e3-3066cb80c0b8", "value": "102448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T11:17:27+00:00", "last_seen": "2024-07-10T11:17:27+00:00", "object_relation": "vhash", "timestamp": "1784555027", "to_ids": true, "type": "vhash", "uuid": "dda52ee1-9953-4805-82f0-4109d76f049a", "value": "115046655d156az41?z1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784560831", "uuid": "3308ce51-abec-499f-ae22-361ebd83f948", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "md5", "timestamp": "1784560831", "to_ids": true, "type": "md5", "uuid": "1d2abb55-1730-48cd-a4b0-2c2c3e8f1dc8", "value": "e0552b0cd0807d18e5a402d50b0e12d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "sha1", "timestamp": "1784557338", "to_ids": true, "type": "sha1", "uuid": "19f0307a-0cf1-49ec-b52e-eab730da5e3c", "value": "ce8c51a052819ae7d1279a3733dfdcec0231a18f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "sha256", "timestamp": "1784557338", "to_ids": true, "type": "sha256", "uuid": "9187eb0f-eb40-43dd-a202-2cc035387350", "value": "dd778869414591464c6d34708ed7c91affad8ecd16355d54a6d8fe95ee553c83", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "text", "timestamp": "1784555048", "to_ids": false, "type": "text", "uuid": "761f9bb4-26ac-43bd-a109-c4042df931de", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: Win.Trojan.Generic-10040693-0\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2024-07-08T03:24:55+00:00\nFirst Submission: 2024-07-10T10:48:11+00:00\nLast Submission: 2024-07-10T10:48:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "creation-time", "timestamp": "1784555048", "to_ids": false, "type": "datetime", "uuid": "65a91709-8b8c-4420-80d4-ba626fea1ca5", "value": "2024-07-07T06:40:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "ssdeep", "timestamp": "1784555048", "to_ids": true, "type": "ssdeep", "uuid": "fb8ed321-5830-4b2a-977d-e954a666fb31", "value": "3072:8R9LipcSuc23C/vdu1Jl5zOAav5tQOrtQOX:8RCcx3CdIOAav5xp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555048", "to_ids": false, "type": "size-in-bytes", "uuid": "a6cfd3b3-a6e1-42dc-be04-611f3f35e509", "value": "102448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "vhash", "timestamp": "1784555048", "to_ids": true, "type": "vhash", "uuid": "4d5c13de-5e94-4cf7-8c36-26c78697deda", "value": "115046655d156az41?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-10T10:48:11+00:00", "last_seen": "2024-07-10T10:48:11+00:00", "object_relation": "filename", "timestamp": "1784555048", "to_ids": true, "type": "filename", "uuid": "df77444a-dad5-45bd-b595-d2d0bed9554f", "value": "dttcodexgigas.ce8c51a052819ae7d1279a3733dfdcec0231a18f" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557339", "uuid": "8d816f4b-1db3-4456-a21e-3d20df56da61", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "md5", "timestamp": "1784557339", "to_ids": true, "type": "md5", "uuid": "0776f97f-d7a5-405f-b46a-26e17856e86c", "value": "f2f1013b009c44d12275d2eda2f45dab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "sha1", "timestamp": "1784557339", "to_ids": true, "type": "sha1", "uuid": "3d6542ae-5892-4e95-9371-5574fcf170b9", "value": "99eba2138b916f093612ca8e4972929ce21fb393", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "sha256", "timestamp": "1784557339", "to_ids": true, "type": "sha256", "uuid": "27463aa9-01c9-4892-80b5-5ee8ae7e6b3e", "value": "3ea2ea5bc18629410ba51e257ee8316955caf8abc2636c1cb42c5e908c7d66d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "text", "timestamp": "1784555070", "to_ids": false, "type": "text", "uuid": "850a8005-bc73-4a82-857c-b8c5e41e2753", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: Win.Trojan.Generic-10040693-0\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2024-07-12T23:08:55+00:00\nFirst Submission: 2024-07-12T21:07:14+00:00\nLast Submission: 2024-07-12T21:07:14+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "creation-time", "timestamp": "1784555070", "to_ids": false, "type": "datetime", "uuid": "18885d6e-c787-40b3-a12b-5d1b88a1e434", "value": "2024-07-07T06:40:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "ssdeep", "timestamp": "1784555070", "to_ids": true, "type": "ssdeep", "uuid": "651ef287-5a91-48e3-b9d6-7a347bc3fb45", "value": "1536:8R9V6GNEpLgSuG3r23C/v2UnRtjSZvhasWBcdlQ0zOAavATxbtQo/ZVtQo/dix:8R9LipcSuc23C/vdu1Jl5zOAav2tQO7+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555070", "to_ids": false, "type": "size-in-bytes", "uuid": "5645e7e2-174b-431d-b811-9b820dd78d87", "value": "95696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "vhash", "timestamp": "1784555070", "to_ids": true, "type": "vhash", "uuid": "dcb5c868-c0dc-4f58-b99a-038ae6dd78d9", "value": "194046655d156az41?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-12T21:07:14+00:00", "last_seen": "2024-07-12T21:07:14+00:00", "object_relation": "filename", "timestamp": "1784555070", "to_ids": true, "type": "filename", "uuid": "d7648b0d-ffab-4030-8546-25838cd61a20", "value": "m7bu9w5b.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557341", "uuid": "c8747c3d-a52d-4905-97d1-c2caec898c1a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "md5", "timestamp": "1784557341", "to_ids": true, "type": "md5", "uuid": "b1194de9-ef7b-4e5e-9a99-f7f1f902ab1f", "value": "1594cf926460ce3a0aee7da14d10f862", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "sha1", "timestamp": "1784557341", "to_ids": true, "type": "sha1", "uuid": "da16f8bd-3bde-4ace-ab80-bdd762392117", "value": "c2f8eb97fb8ed3f2250a2fedc404fb8bd6fc92f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "sha256", "timestamp": "1784557341", "to_ids": true, "type": "sha256", "uuid": "58bfdf9e-c94f-4427-9900-82c4e95d2e3e", "value": "e19c7fa9caee8bb3ba1a8da36c2698388597143f261736b40033d01b4a89de2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "text", "timestamp": "1784555091", "to_ids": false, "type": "text", "uuid": "ec0e2e9f-d7b2-45be-ad84-ee61830b44c8", "value": "Type Description: Win32 EXE\nOriginal nam%WINDIR%\\ormsApp3.exe\nVerified: Signed\nSigning date: 02:22 AM 07/13/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2024-07-15T08:30:13+00:00\nFirst Submission: 2024-07-15T06:27:10+00:00\nLast Submission: 2024-07-15T06:27:10+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "creation-time", "timestamp": "1784555091", "to_ids": false, "type": "datetime", "uuid": "e9995020-1cc8-43a0-a7a5-434042c96643", "value": "2038-03-17T13:01:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "ssdeep", "timestamp": "1784555091", "to_ids": true, "type": "ssdeep", "uuid": "43876222-551c-401c-a1f3-6ed23a221c7e", "value": "1536:zsc8jINKRyGOK5m0g69izUxbtQo/lKqtQo/Nm6ix:wc8jAKkGOKw0g6ozatQORtQO4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555091", "to_ids": false, "type": "size-in-bytes", "uuid": "2f09d0c7-0fe3-47c3-9643-fc6ea3bff4f2", "value": "54328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "vhash", "timestamp": "1784555091", "to_ids": true, "type": "vhash", "uuid": "36f3ef82-125f-472c-a325-f18e9330c658", "value": "254036755511b0856e1025" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-15T06:27:10+00:00", "last_seen": "2024-07-15T06:27:10+00:00", "object_relation": "filename", "timestamp": "1784555091", "to_ids": true, "type": "filename", "uuid": "d03d9e3d-71db-49ec-ba5a-4fb5ee21b910", "value": "WindowsFormsApp3.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557342", "uuid": "a3283886-dcb7-4364-bf17-16892c9e0f59", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "md5", "timestamp": "1784557342", "to_ids": true, "type": "md5", "uuid": "71965876-ce30-4068-b13b-82b1380bd07e", "value": "d30677b807f9dac82d52a0a67b871860", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "sha1", "timestamp": "1784557342", "to_ids": true, "type": "sha1", "uuid": "943f0218-972c-48d5-81fe-fb8ecd1471fd", "value": "ce7b63610e70a6f4618cc16ac736ac426173a008", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "sha256", "timestamp": "1784557342", "to_ids": true, "type": "sha256", "uuid": "bfb61e97-f6cd-47b2-8720-57df3082dfea", "value": "402473edb758987e464918b497f42928cbacde1013418e10373b704415f42b91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "text", "timestamp": "1784555113", "to_ids": false, "type": "text", "uuid": "8999ce8d-c386-4266-ade7-3e54df086b78", "value": "Type Description: Win32 EXE\nOriginal nam%WINDIR%\\ormsApp3.exe\nVerified: Signed\nSigning date: 02:21 AM 07/13/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2024-07-17T21:00:06+00:00\nFirst Submission: 2024-07-17T18:59:00+00:00\nLast Submission: 2024-09-13T15:54:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "creation-time", "timestamp": "1784555113", "to_ids": false, "type": "datetime", "uuid": "3222bd00-1f7a-42ab-b463-f91a4a4c8725", "value": "2038-03-17T13:01:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "ssdeep", "timestamp": "1784555113", "to_ids": true, "type": "ssdeep", "uuid": "f34d2545-ca47-4e2d-af3b-9a09fc953151", "value": "1536:5sc8jINKRyGOK5m0g69izBxbtQo/VKntQo/5m6dxVH:mc8jAKkGOKw0g6ozbtQOAtQOkIH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555113", "to_ids": false, "type": "size-in-bytes", "uuid": "b1ce2cbb-2dc3-47b4-8590-8c219ff9d103", "value": "54320" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "vhash", "timestamp": "1784555113", "to_ids": true, "type": "vhash", "uuid": "eefe46ab-2620-401f-9380-eca888ef213d", "value": "254036755511b0856e1025" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-17T18:59:00+00:00", "last_seen": "2024-09-13T15:54:36+00:00", "object_relation": "filename", "timestamp": "1784555113", "to_ids": true, "type": "filename", "uuid": "8f9ea6b0-4c70-4044-a467-dadbd23618c5", "value": "WindowsFormsApp3.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557344", "uuid": "833734e5-c122-4c60-88e5-b8c1e999612d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "md5", "timestamp": "1784557343", "to_ids": true, "type": "md5", "uuid": "edc11d80-d739-403d-bded-4ea9c1d42a13", "value": "893149115281c96590cefb70ed7d26a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "sha1", "timestamp": "1784557344", "to_ids": true, "type": "sha1", "uuid": "d0c168c8-cae1-49d1-84b4-97ea5e196700", "value": "d1a3bb6c7b3be731d2cecefeec7c3117974be45b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "sha256", "timestamp": "1784557344", "to_ids": true, "type": "sha256", "uuid": "a6a69197-9361-4904-bcd9-fc4f186f3860", "value": "fca16d76655f7b0bb7c39f2230843598e0c4569fea3e7676381f2ba4311dc5c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "text", "timestamp": "1784555134", "to_ids": false, "type": "text", "uuid": "e15d4337-14eb-4b5b-9bab-79069842abcc", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 05:44 AM 07/11/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2024-07-18T06:27:16+00:00\nFirst Submission: 2024-07-17T09:24:32+00:00\nLast Submission: 2024-07-17T09:24:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "creation-time", "timestamp": "1784555134", "to_ids": false, "type": "datetime", "uuid": "f0345c42-b69a-4911-9fd2-107d8db68e3b", "value": "2024-07-07T06:40:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "ssdeep", "timestamp": "1784555134", "to_ids": true, "type": "ssdeep", "uuid": "6b2805f8-43f6-40f6-a338-f2bc2ed28fd9", "value": "12288:80av2MnSGsEV8EsXZamlS4MZo/XzekrA79Ya3U7m8jTO/qDePt:8v+MnSmsauYo7tA+/73TO/qDePt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555134", "to_ids": false, "type": "size-in-bytes", "uuid": "e7894185-5892-42e2-9d02-7632d6803d09", "value": "729136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "vhash", "timestamp": "1784555134", "to_ids": true, "type": "vhash", "uuid": "083042cc-ba0e-4de1-a12b-a704542bc419", "value": "175086050d060d067d151bz1?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-17T09:24:32+00:00", "last_seen": "2024-07-17T09:24:32+00:00", "object_relation": "filename", "timestamp": "1784555134", "to_ids": true, "type": "filename", "uuid": "54981bbb-1c35-4b46-b874-b77488f143e5", "value": "Comn.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557345", "uuid": "c6cb205d-4a59-4708-a198-5d9cbe92a730", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "md5", "timestamp": "1784557345", "to_ids": true, "type": "md5", "uuid": "b19fec9b-c50a-45ff-a739-7439a54fc54a", "value": "8123be7361de3700f9775307486a5400", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "sha1", "timestamp": "1784557345", "to_ids": true, "type": "sha1", "uuid": "d03acd55-d73f-4fdf-a321-f3178fc69c4a", "value": "d6e7fe965bb137c6b55f69e6f074cf8c41698d37", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "sha256", "timestamp": "1784557345", "to_ids": true, "type": "sha256", "uuid": "e2fb30bb-e87f-472b-906a-9136e20364fa", "value": "b15f03c175f0f9b6b2add1a12e54d47da9af3ec4aede55e56f64c2be51b68136", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "text", "timestamp": "1784555156", "to_ids": false, "type": "text", "uuid": "60ff9262-2bd9-4afc-bf00-896c9f022973", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2024-07-18T08:33:31+00:00\nFirst Submission: 2024-07-18T05:59:56+00:00\nLast Submission: 2024-07-18T06:31:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "creation-time", "timestamp": "1784555157", "to_ids": false, "type": "datetime", "uuid": "ebdd600b-e6fc-416f-a9ad-5360806bee3b", "value": "2024-07-07T06:40:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "ssdeep", "timestamp": "1784555156", "to_ids": true, "type": "ssdeep", "uuid": "892dbca2-5a12-4045-8e16-a1cc1c096349", "value": "1536:yR9V6GNEpLgSuG3r23C/v2UnRtjSZvhasWBcdlQ0zExbtQo/lMtQo/Nihx:yR9LipcSuc23C/vdu1Jl5zqtQOatQO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555156", "to_ids": false, "type": "size-in-bytes", "uuid": "2235bec4-6bfa-4657-a3b9-6c447a77d192", "value": "102456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "vhash", "timestamp": "1784555156", "to_ids": true, "type": "vhash", "uuid": "b1abe114-9a23-4deb-aa13-3da515a6ecc6", "value": "115046655d15bz41?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-18T05:59:56+00:00", "last_seen": "2024-07-18T06:31:37+00:00", "object_relation": "filename", "timestamp": "1784555156", "to_ids": true, "type": "filename", "uuid": "1aa8bdfd-3b5c-41c9-8917-deb402075a0e", "value": "opxtjy.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557346", "uuid": "fbc2c574-f6e2-4fb6-86f3-3c06eead8990", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "md5", "timestamp": "1784557346", "to_ids": true, "type": "md5", "uuid": "c4dfc04a-dbc4-4914-9f59-02aede5ff415", "value": "3951794704e12de01ff4e951c3f53280", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "sha1", "timestamp": "1784557346", "to_ids": true, "type": "sha1", "uuid": "0033bdd3-f0ec-4510-a8fd-138f79a2de1f", "value": "08e3f1662a961be302fb93a81f31e5cdc22df78c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "sha256", "timestamp": "1784557346", "to_ids": true, "type": "sha256", "uuid": "7cb2c4a9-e423-44cc-93d9-cd70aaefafc4", "value": "4dec1fe1485727a83d20f3a1223a1e5d900d9e77ec724d1c8b938b4f177d8422", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "text", "timestamp": "1784555178", "to_ids": false, "type": "text", "uuid": "1e330177-b7a1-4ab6-85e5-a791f98c4e17", "value": "Type Description: Win32 DLL\nOriginal name: d3dcompiler_43.dll\nVerified: Signed\nSigning date: 02:49 PM 07/01/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2024-07-22T12:55:12+00:00\nLast Submission: 2024-11-27T07:24:15+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "creation-time", "timestamp": "1784555178", "to_ids": false, "type": "datetime", "uuid": "da4359b6-0ab9-47c5-ab4d-b35570c1418a", "value": "2024-06-25T17:46:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "ssdeep", "timestamp": "1784555178", "to_ids": true, "type": "ssdeep", "uuid": "c9910d8d-a255-4497-9d19-d8fe7dd4083d", "value": "1536:X3s8LCHbwvsJat1ejwcLV5jxbtQo/l4MZtQo/NAx:X3sKIdazcB5NtQOHtQO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555178", "to_ids": false, "type": "size-in-bytes", "uuid": "a609a199-4e3c-4079-9256-8a1cd0d4415c", "value": "71224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "vhash", "timestamp": "1784555178", "to_ids": true, "type": "vhash", "uuid": "7d15707d-5526-4baa-9426-9e148eaedca3", "value": "17403e0f7d1bz5?z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-22T12:55:12+00:00", "last_seen": "2024-11-27T07:24:15+00:00", "object_relation": "filename", "timestamp": "1784555178", "to_ids": true, "type": "filename", "uuid": "3fb24757-a895-41f1-96f9-4b2f30e9ca68", "value": "d3dcompiler_43.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557347", "uuid": "d85477db-84e4-4207-bede-54ab17137218", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "md5", "timestamp": "1784557347", "to_ids": true, "type": "md5", "uuid": "11b87d12-d333-4c48-8a59-9bc1075f0e76", "value": "087ea86ab1ec35c1e0d6d8342d604790", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "sha1", "timestamp": "1784557347", "to_ids": true, "type": "sha1", "uuid": "0a99a038-393c-439d-9cc6-048aaa9ce388", "value": "b49df06059b8d62940d5153b03062c6a31391863", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "sha256", "timestamp": "1784557347", "to_ids": true, "type": "sha256", "uuid": "80f1e968-e835-46d3-a3de-5ac9b0d7a772", "value": "3ed712995f7f483ae058c6c8ac3f06ff03d9a83bf0a1ceb0918e896438b82108", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "text", "timestamp": "1784555200", "to_ids": false, "type": "text", "uuid": "28a9ac2b-0b32-4d63-986f-0da6974b0db9", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 07:46 AM 07/23/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 33/74\nFirst Seen In The Wild: 2024-07-24T03:51:03+00:00\nFirst Submission: 2024-07-23T11:43:02+00:00\nLast Submission: 2024-07-25T23:40:34+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "creation-time", "timestamp": "1784555200", "to_ids": false, "type": "datetime", "uuid": "11b1b933-9c92-49f7-b7fb-18726771d492", "value": "2024-07-16T05:23:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "ssdeep", "timestamp": "1784555200", "to_ids": true, "type": "ssdeep", "uuid": "3f8fc2f7-645f-4aa9-a53a-2a774053f75a", "value": "768:kShbhffZENAMxb2gQ4R/lO8l2gQ4R/Nx4AMxkEn:z1dfCxbtQo/lptQo/Nxmx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555200", "to_ids": false, "type": "size-in-bytes", "uuid": "bc70ea39-ded5-4320-a5e4-5c42526368d2", "value": "31800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "vhash", "timestamp": "1784555200", "to_ids": true, "type": "vhash", "uuid": "6e15496a-7c11-4bfe-83ab-3008dc82daaf", "value": "134046651d155bzb?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-23T11:43:02+00:00", "last_seen": "2024-07-25T23:40:34+00:00", "object_relation": "filename", "timestamp": "1784555200", "to_ids": true, "type": "filename", "uuid": "48136f0e-4788-44a0-bae8-ca5a8a69506f", "value": "Update.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557348", "uuid": "ec3a10a1-c7b1-45f3-b631-6c8014b648ae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "md5", "timestamp": "1784557348", "to_ids": true, "type": "md5", "uuid": "64018fbc-ae9b-4918-af6e-f181c8faebfb", "value": "7a56cce8f54b9f6e56c9f1da6d49eb0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "sha1", "timestamp": "1784557348", "to_ids": true, "type": "sha1", "uuid": "8c82d617-8a7c-4b0e-9a0e-0609bdea2ef4", "value": "6a160503a13f3795e06ba37d6ac1238e1d74863a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "sha256", "timestamp": "1784557348", "to_ids": true, "type": "sha256", "uuid": "a2acbda1-856f-4e96-a831-8b1512037ec2", "value": "ae9c13234a3884ae3668c7d4f120603c28900850837818ba6f8af88d5f5c42d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "text", "timestamp": "1784555222", "to_ids": false, "type": "text", "uuid": "56a42390-006c-4ed8-af69-489e3989b38c", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 05:46 AM 07/20/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2024-07-24T11:41:42+00:00\nLast Submission: 2024-07-25T00:33:48+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "creation-time", "timestamp": "1784555222", "to_ids": false, "type": "datetime", "uuid": "8e51d7ba-b041-4cac-8436-6728d407bea6", "value": "2024-07-15T13:18:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "ssdeep", "timestamp": "1784555222", "to_ids": true, "type": "ssdeep", "uuid": "c4e76cd3-a908-4a6e-9287-f6f0d98b1b02", "value": "768:lShbv/sENAMxb2gQ4R/V2qU2gQ4R/5aAMxkEZ:s1v/JxbtQo/V3UtQo/5Yxl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555222", "to_ids": false, "type": "size-in-bytes", "uuid": "880ef2ed-a4cc-45ae-abd7-0335180df55a", "value": "31792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "vhash", "timestamp": "1784555222", "to_ids": true, "type": "vhash", "uuid": "95e8201f-6123-43a6-8fd1-0e30608d6735", "value": "134046651d155bzb?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-07-24T11:41:42+00:00", "last_seen": "2024-07-25T00:33:48+00:00", "object_relation": "filename", "timestamp": "1784555222", "to_ids": true, "type": "filename", "uuid": "8924fa36-3495-4288-adde-056f3c8424e5", "value": "Comn.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557349", "uuid": "ff28611a-8acd-4a8c-92cd-2650af60b8a4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "md5", "timestamp": "1784557349", "to_ids": true, "type": "md5", "uuid": "d34a0c21-290e-4fdd-b7ff-3f040320a5ed", "value": "dc9546b9e55d18d2b875af2490c64e24", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "sha1", "timestamp": "1784557349", "to_ids": true, "type": "sha1", "uuid": "3d1fff30-1b40-473a-bebe-68ede06a2e33", "value": "e6879999bc3c0a767da8d8f781c274ecf85a9758", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "sha256", "timestamp": "1784557349", "to_ids": true, "type": "sha256", "uuid": "f15db139-4d60-4d9c-9356-d19892868cde", "value": "25e943f5b2a6932fbe38a9d5bc4d8bd81492f1861f080a2290d85a201a87244a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "text", "timestamp": "1784555244", "to_ids": false, "type": "text", "uuid": "41a396ec-9174-4cde-a880-8ca82dbe3d17", "value": "Type Description: Win32 EXE\nOriginal nam%WINDIR%\\ormsApp3.exe\nVerified: Signed\nSigning date: 05:29 PM 08/29/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2024-08-29T18:00:54+00:00\nLast Submission: 2024-08-29T18:00:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "creation-time", "timestamp": "1784555244", "to_ids": false, "type": "datetime", "uuid": "3fbf81ad-7ac6-4264-98bd-809721e22514", "value": "2068-02-27T22:24:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "ssdeep", "timestamp": "1784555244", "to_ids": true, "type": "ssdeep", "uuid": "fa453d46-276a-4722-a315-5a0d875153a5", "value": "49152:hVqbTqbESsHw2oReFbTPutHfOZQuSlZ17B+U8ZS6FS7vLmCAoy:TqbTqQS1heZTm4ZbuZj+QiS0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555244", "to_ids": false, "type": "size-in-bytes", "uuid": "5e2514bc-5338-45d2-97ac-1e7cd6412a5c", "value": "2255928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "vhash", "timestamp": "1784555244", "to_ids": true, "type": "vhash", "uuid": "364d1d86-cbee-4daf-8348-77c95dc1d76a", "value": "226066060665157673608b601330138" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-08-29T18:00:54+00:00", "last_seen": "2024-08-29T18:00:54+00:00", "object_relation": "filename", "timestamp": "1784555244", "to_ids": true, "type": "filename", "uuid": "f78b1dc9-9bf8-49f4-b56c-0d006c74735c", "value": "WindowsFormsApp3.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557350", "uuid": "8908a2d9-17f7-4c30-b6fa-82b054fb7814", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "md5", "timestamp": "1784557350", "to_ids": true, "type": "md5", "uuid": "02ad933d-9e72-411d-9572-84f814d981ab", "value": "bc843a7e3aa8abd384899bab1e099900", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "sha1", "timestamp": "1784557350", "to_ids": true, "type": "sha1", "uuid": "740f12f9-ecb7-44f0-ad79-e70c111c86d7", "value": "30dceef47d17a926992f1413a32984757dbca089", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "sha256", "timestamp": "1784557350", "to_ids": true, "type": "sha256", "uuid": "d959f2bc-c61c-49e4-b2aa-62ba913f25e1", "value": "1ef9bb97a9929fb3f6813b869df488d5d93ecfe74420340ae36208f32037ae98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "text", "timestamp": "1784555265", "to_ids": false, "type": "text", "uuid": "719ad806-880c-49f5-b65a-462fd8e07dec", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 39/74\nFirst Submission: 2024-09-05T18:35:00+00:00\nLast Submission: 2024-09-05T18:35:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "creation-time", "timestamp": "1784555265", "to_ids": false, "type": "datetime", "uuid": "4c47d8cc-a3be-4fd6-b32c-4f950bd4f9a7", "value": "2024-07-30T10:17:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "ssdeep", "timestamp": "1784555265", "to_ids": true, "type": "ssdeep", "uuid": "00cc0d43-949e-4747-86d4-a663772a859a", "value": "3072:wXVIAI0nQmlnlmns6pp5H2cp/6ujQdVoPUVBU+/UfvGVFk9gT76w0Y4X7tQOGftL:wXxf1Ks6xHYoPUf82Hz0Yg2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555265", "to_ids": false, "type": "size-in-bytes", "uuid": "6af99c65-120b-4fa0-8d96-f840f9a55e7f", "value": "178744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "vhash", "timestamp": "1784555265", "to_ids": true, "type": "vhash", "uuid": "25110a6b-1ac5-4902-82cf-866d689adf49", "value": "115076655d551665651az45=za9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T18:35:00+00:00", "last_seen": "2024-09-05T18:35:00+00:00", "object_relation": "filename", "timestamp": "1784555265", "to_ids": true, "type": "filename", "uuid": "d3629fce-11e2-4c53-bdb3-68b76de73cae", "value": "dttcodexgigas.30dceef47d17a926992f1413a32984757dbca089" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557352", "uuid": "fa0dfe7b-8e6f-44d5-9c80-a20d03f5d4ff", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "md5", "timestamp": "1784557351", "to_ids": true, "type": "md5", "uuid": "8443f4e4-e0cf-4238-985b-f91fa69f20e2", "value": "0aa7ac47e81e304813647679141db132", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "sha1", "timestamp": "1784557352", "to_ids": true, "type": "sha1", "uuid": "8e5a8b55-7832-453b-bd6c-9648901908e1", "value": "4f0aeff2d2186f71a40177baf5eaa8f6c46999d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "sha256", "timestamp": "1784557352", "to_ids": true, "type": "sha256", "uuid": "444b43e3-e8ce-4b0f-976b-abcb7eaa7a26", "value": "bb3c3fde8b2fd71c8d85a2aeda9f173fcba4ec214b860d69618f9444692d2c50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "text", "timestamp": "1784555287", "to_ids": false, "type": "text", "uuid": "340337d6-7f4e-426f-b772-8c7117b6b93d", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 08:27 PM 08/31/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2024-09-06T07:15:37+00:00\nFirst Submission: 2024-09-05T13:38:39+00:00\nLast Submission: 2024-09-05T15:13:31+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "creation-time", "timestamp": "1784555287", "to_ids": false, "type": "datetime", "uuid": "7a36f3ab-2751-4377-997e-d323ac6153db", "value": "2024-07-30T10:17:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "ssdeep", "timestamp": "1784555287", "to_ids": true, "type": "ssdeep", "uuid": "25122968-0c47-48b0-adf7-75a961a2c563", "value": "3072:7u5L6JxN5N46ib5ium9IhsOSLUcz7KN+PmentQOGftQO:a5WF5N4LLuOSLfnPmen2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555287", "to_ids": false, "type": "size-in-bytes", "uuid": "0c0ae97f-8867-4789-9ae6-313e223901a1", "value": "132664" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "vhash", "timestamp": "1784555287", "to_ids": true, "type": "vhash", "uuid": "235cc7eb-c047-49e5-8614-1cecd8b3234d", "value": "11503e0f7d5bz5=za9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T13:38:39+00:00", "last_seen": "2024-09-05T15:13:31+00:00", "object_relation": "filename", "timestamp": "1784555287", "to_ids": true, "type": "filename", "uuid": "b36054fc-ecaf-4d5b-905d-4d45553a81ea", "value": "sentry.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557353", "uuid": "8744f124-12c5-454a-8836-843c1745ea01", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "md5", "timestamp": "1784557353", "to_ids": true, "type": "md5", "uuid": "1a84a8c2-3538-41f5-96de-f289a636154d", "value": "43b9e7c405d21473c92b48f4ac69bb07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "sha1", "timestamp": "1784557353", "to_ids": true, "type": "sha1", "uuid": "7a9a8888-996e-4b37-a064-db230d883422", "value": "a1762c059169aa032d34798228dc77121bb7abbe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "sha256", "timestamp": "1784557353", "to_ids": true, "type": "sha256", "uuid": "08debc94-bfd8-4bec-aeb4-93b38fc73153", "value": "5c682070e14bf442d9973400ba9b21baf32908c19422a9ab0c432dea08e7b8d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "text", "timestamp": "1784555309", "to_ids": false, "type": "text", "uuid": "b07612d7-12aa-4b0b-ab07-bbaba7628592", "value": "Type Description: Win32 EXE\nOriginal name: SoftMgr.exe\nVerified: Signed\nSigning date: 05:31 PM 09/03/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 39/74\nFirst Submission: 2024-09-05T13:35:36+00:00\nLast Submission: 2024-09-05T13:47:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "creation-time", "timestamp": "1784555309", "to_ids": false, "type": "datetime", "uuid": "1ac7d4fd-1d5f-4775-86f7-1fceb8dc9685", "value": "2024-09-03T15:03:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "ssdeep", "timestamp": "1784555309", "to_ids": true, "type": "ssdeep", "uuid": "adc4f303-a01c-43e3-9846-dfe0fd382fbe", "value": "49152:X+bmmYmRfNigByPVjkbFVN6sgLqz9V2Dp0Ol/FlmxcaVt:X+b7YQVSA/NHzrTO9Fgtt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555309", "to_ids": false, "type": "size-in-bytes", "uuid": "58cf9d3c-9467-47cb-9719-464a8c0853e6", "value": "3675704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "vhash", "timestamp": "1784555309", "to_ids": true, "type": "vhash", "uuid": "32602e9a-dd0c-4a52-ad3a-65068806dc7b", "value": "0360c6050d050505660dcz1!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-05T13:35:36+00:00", "last_seen": "2024-09-05T13:47:25+00:00", "object_relation": "filename", "timestamp": "1784555309", "to_ids": true, "type": "filename", "uuid": "927dd877-ddc3-497f-a7c2-b5ad5b7def8a", "value": "SoftMgr.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557354", "uuid": "bd235ada-711b-437d-b658-e089f9259144", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "md5", "timestamp": "1784557354", "to_ids": true, "type": "md5", "uuid": "bf30a256-a8fb-4a92-9d78-e00ee14ecb5e", "value": "5d6907d61bf9e6682fde52eef71fbf3d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "sha1", "timestamp": "1784557354", "to_ids": true, "type": "sha1", "uuid": "e59038d6-9f36-47a0-a0ef-4b68abd332c3", "value": "5bd0f4af6ddaced2ad4646579a8a286fdec682d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "sha256", "timestamp": "1784557354", "to_ids": true, "type": "sha256", "uuid": "6e0c8c6e-949c-44c0-9009-561a3250e79a", "value": "5a80b01823f4639281d2738177fccfc0dbd9b62ac4ce1d1360f7d48e9bad6fad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "text", "timestamp": "1784555330", "to_ids": false, "type": "text", "uuid": "0af3283f-0c83-48a8-8eec-cb7bdaf8c520", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 09:52 PM 09/24/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2024-09-24T22:15:18+00:00\nLast Submission: 2024-09-24T22:15:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "creation-time", "timestamp": "1784555330", "to_ids": false, "type": "datetime", "uuid": "e106c752-6172-4b6a-b852-a83621f57351", "value": "2024-07-30T10:17:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "ssdeep", "timestamp": "1784555330", "to_ids": true, "type": "ssdeep", "uuid": "15d118c8-5686-4112-b09d-cd511c4dccaf", "value": "3072:EXVIAI0nQmlnlmns6pp5H2cp/6ujQdVoPUVBU+/UfvGVFk9gT76w0Y4X7tQOGftU:EXxf1Ks6xHYoPUf82Hz0Yg2JsT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555330", "to_ids": false, "type": "size-in-bytes", "uuid": "eef8618c-d812-4ba9-b193-b13f4f077a07", "value": "199784" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "vhash", "timestamp": "1784555330", "to_ids": true, "type": "vhash", "uuid": "d930053e-f6fd-4216-af6b-4f034b826269", "value": "115076655d551665651az45=za9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-09-24T22:15:18+00:00", "last_seen": "2024-09-24T22:15:18+00:00", "object_relation": "filename", "timestamp": "1784555330", "to_ids": true, "type": "filename", "uuid": "20afa4a1-d40d-4506-94bb-846a4ed8bbca", "value": "sentry.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557356", "uuid": "479256f0-a8e2-4144-a66f-6f8d08fd14df", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "md5", "timestamp": "1784557356", "to_ids": true, "type": "md5", "uuid": "f2bf0222-b95b-4f5c-8b75-a5a35e3d1f48", "value": "d5907221a6cdec7f2eb29d76b458c283", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "sha1", "timestamp": "1784557356", "to_ids": true, "type": "sha1", "uuid": "35506ea4-7172-4392-b940-2731ec42c4ce", "value": "261878f269f427b0154ba99f046f18372a8e1cd8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "sha256", "timestamp": "1784557356", "to_ids": true, "type": "sha256", "uuid": "1d11fa5e-09c0-42ae-8b37-8640f5be2650", "value": "0a919f79e7091287ce5b143eaa159b942bca1a33d6494ebb41842b802577bdbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "text", "timestamp": "1784555352", "to_ids": false, "type": "text", "uuid": "f7aca644-4d05-4953-a40f-68f6dd30a143", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: Signed\nSigning date: 02:33 PM 09/24/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2024-10-01T00:31:42+00:00\nLast Submission: 2024-10-02T14:38:58+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "creation-time", "timestamp": "1784555352", "to_ids": false, "type": "datetime", "uuid": "379fca78-8b45-43b2-9579-88b90628a65e", "value": "2009-12-11T11:47:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "ssdeep", "timestamp": "1784555352", "to_ids": true, "type": "ssdeep", "uuid": "9860aec7-4222-4503-b29d-ec2bdc3f8f75", "value": "786432:Cgoeal4Mq+V1zTrPs7ioSP6uPHBhL0jYFt0H5PlUWyfF:C/D4MPzfUetPolUW+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555352", "to_ids": false, "type": "size-in-bytes", "uuid": "3f2d3a94-0d19-45de-974b-ade67047affd", "value": "33128448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "vhash", "timestamp": "1784555352", "to_ids": true, "type": "vhash", "uuid": "b2a92bd7-6b25-4493-aaa9-e742541109da", "value": "999e5f00a9a0894e30eeffed5824f496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-01T00:31:42+00:00", "last_seen": "2024-10-02T14:38:58+00:00", "object_relation": "filename", "timestamp": "1784555352", "to_ids": true, "type": "filename", "uuid": "27a40287-08d1-449c-a5d0-5d578754873d", "value": "0a919f79e7091287ce5b143eaa159b942bca1a33d6494ebb41842b802577bdbb.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557357", "uuid": "e10e6076-0c8a-4251-889e-2407c8a9d75b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "md5", "timestamp": "1784557357", "to_ids": true, "type": "md5", "uuid": "b1c8e92e-bb39-4089-a2fe-8525912337f5", "value": "6dc4c3e3356329bf44d8569ba55f8eb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "sha1", "timestamp": "1784557357", "to_ids": true, "type": "sha1", "uuid": "fe4f2aab-c10c-4441-a3aa-0c79e21686d1", "value": "1b0d8f005e8cd92eff2c96d850d569f21060163a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "sha256", "timestamp": "1784557357", "to_ids": true, "type": "sha256", "uuid": "433612dc-6223-4d06-8671-2362abdc3ed1", "value": "d016fb086b0f4b139d425aa13198107beccfb754eb3a2b0c88286f7779ad7c52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "text", "timestamp": "1784555373", "to_ids": false, "type": "text", "uuid": "cabc9337-895b-413a-bbc7-b71cb354c635", "value": "Type Description: Win32 EXE\nOriginal name: ChampComms.exe\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 08:27 AM 06/07/2023\nSigners: Eugene Investment & Securities Co.,Ltd; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2024-10-06T10:34:12+00:00\nLast Submission: 2024-10-06T10:34:12+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "creation-time", "timestamp": "1784555374", "to_ids": false, "type": "datetime", "uuid": "44550299-768f-4628-9e7a-8b224bce375c", "value": "2023-03-24T00:41:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "ssdeep", "timestamp": "1784555373", "to_ids": true, "type": "ssdeep", "uuid": "ee198db1-535c-4ba4-ad17-79fde62dadd4", "value": "3072:JTa7gq26DmUeI/TBf+q7ox3J6wVyAyjwD7Lg7fZyH/5K/+x9n:FACI/TBmqQyAyjwDHgTZyn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555373", "to_ids": false, "type": "size-in-bytes", "uuid": "11e417b3-d570-418e-ab1b-7ffb85792ccb", "value": "153664" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "vhash", "timestamp": "1784555373", "to_ids": true, "type": "vhash", "uuid": "21a5b333-e96f-4ad6-8e2d-7011f01a5097", "value": "015046656d155az2chz2011zf4z140700341z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-06T10:34:12+00:00", "last_seen": "2024-10-06T10:34:12+00:00", "object_relation": "filename", "timestamp": "1784555373", "to_ids": true, "type": "filename", "uuid": "cab969f8-b99c-46cf-ae38-75eb1a3857be", "value": "ChampComms.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557358", "uuid": "9a2bea8f-27ea-4fdf-8c63-c2d899221115", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "md5", "timestamp": "1784557358", "to_ids": true, "type": "md5", "uuid": "2b2982c4-720f-46fa-b9c1-b16129a261d7", "value": "ed518ca31ae3fb21ee06dd6ed021a2d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "sha1", "timestamp": "1784557358", "to_ids": true, "type": "sha1", "uuid": "33b3bb72-f3d1-44a1-9ad4-b8cb51e47c84", "value": "dd342f8deb5606acda4b8d6834f402001591086b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "sha256", "timestamp": "1784557358", "to_ids": true, "type": "sha256", "uuid": "a5bfbeb9-efdd-42d0-bf1a-dd09f68e0425", "value": "a8e0bcb0efbf8b63ce093ff930c5562894662999475fa0035abaef963562a499", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "text", "timestamp": "1784555395", "to_ids": false, "type": "text", "uuid": "23eae0c7-5182-44e4-94d6-751be9b97d9c", "value": "Type Description: Win32 DLL\nOriginal name: 360Util.dll\nVerified: Signed\nSigning date: 05:37 PM 10/06/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: VirTool:Win32/VMProtect\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2024-10-08T00:56:12+00:00\nFirst Submission: 2024-10-07T22:55:49+00:00\nLast Submission: 2024-11-01T21:55:19+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "creation-time", "timestamp": "1784555395", "to_ids": false, "type": "datetime", "uuid": "fe1a3751-c8b3-4fbc-99e6-bc5b4960f746", "value": "2024-07-30T10:17:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "ssdeep", "timestamp": "1784555395", "to_ids": true, "type": "ssdeep", "uuid": "8806c520-2169-42b7-adb1-9a2b63f55ae4", "value": "3072:RXVIAI0nQmlnlmns6pp5H2cp/6ujQdVoPUVBU+/UfvGVFk9gT76w0Y4X4UtQOQhC:RXxf1Ks6xHYoPUf82Hz0Y8OhGd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555395", "to_ids": false, "type": "size-in-bytes", "uuid": "a94e7031-ca72-4f41-825c-6622acfecc52", "value": "179752" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "vhash", "timestamp": "1784555395", "to_ids": true, "type": "vhash", "uuid": "ec173644-b8e2-4386-a3fc-a88885a1c1f7", "value": "115076655d551665651az45=za9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-07T22:55:49+00:00", "last_seen": "2024-11-01T21:55:19+00:00", "object_relation": "filename", "timestamp": "1784555395", "to_ids": true, "type": "filename", "uuid": "f64d7ff6-d9f2-4831-b465-9a68ab28a267", "value": "360Util.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557359", "uuid": "0b7472e0-7215-4afb-9f23-6235281493ad", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "md5", "timestamp": "1784557359", "to_ids": true, "type": "md5", "uuid": "aebbcabd-8579-4bde-bfeb-7e715ad47b60", "value": "7229d28fcbbda52198b0ba5f2e6fe2ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "sha1", "timestamp": "1784557359", "to_ids": true, "type": "sha1", "uuid": "53a2677b-10e7-49ee-a0c7-5968676d28af", "value": "f9939974cb562a8a4b0ae62fa64bc6fb515909d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "sha256", "timestamp": "1784557359", "to_ids": true, "type": "sha256", "uuid": "7015e384-e337-454b-ae4d-c00b19b88a1e", "value": "36959e562fa5c24e00b4685fd4367093ed4b3c9897685ee39935920d77505dd4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "text", "timestamp": "1784555417", "to_ids": false, "type": "text", "uuid": "cf413fcb-bd4c-4044-a91b-c58877e47df2", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: Signed\nSigning date: 06:51 AM 10/18/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 41/74\nFirst Submission: 2024-10-18T10:20:30+00:00\nLast Submission: 2024-10-20T18:50:16+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "creation-time", "timestamp": "1784555417", "to_ids": false, "type": "datetime", "uuid": "dab5c6e3-0c75-46ce-b691-6324cde75fc3", "value": "2098-09-22T14:44:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "ssdeep", "timestamp": "1784555417", "to_ids": true, "type": "ssdeep", "uuid": "d1e9a812-b771-4147-a377-982f4a2036c0", "value": "12288:CUqXKGXyhe8D7Hz58SPlpmlSA2AKknz2Sag8AO:waGXdeLzxnmlShknzln8AO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555417", "to_ids": false, "type": "size-in-bytes", "uuid": "5106faf2-6fb5-458d-9894-57a65742accd", "value": "635432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "vhash", "timestamp": "1784555417", "to_ids": true, "type": "vhash", "uuid": "f999d7a2-62d1-4cd3-842b-072df772fd14", "value": "265066060655151672f08125f610127" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-18T10:20:30+00:00", "last_seen": "2024-10-20T18:50:16+00:00", "object_relation": "filename", "timestamp": "1784555417", "to_ids": true, "type": "filename", "uuid": "78640296-f370-4a2e-bd01-0168556f432e", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557360", "uuid": "7b94ac63-b051-4815-8ea6-2960c2b8904f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "md5", "timestamp": "1784557360", "to_ids": true, "type": "md5", "uuid": "ab4dc135-7a2d-4166-b67a-6b3b6fcd98a4", "value": "e1ec08de0183c389485950ff21cfd24c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "sha1", "timestamp": "1784557360", "to_ids": true, "type": "sha1", "uuid": "598c290c-04a7-42df-9602-7d2c58bb0350", "value": "62e444b91de0e7399f23e86a8bae4613e9fb52f6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "sha256", "timestamp": "1784557360", "to_ids": true, "type": "sha256", "uuid": "124ed022-3d9f-46e6-8e25-436b300c9529", "value": "532e97b35149db5010be30f6619d76e1e987c29133416f87a860ff886b141d3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "text", "timestamp": "1784555438", "to_ids": false, "type": "text", "uuid": "c92d3718-5386-49d7-9660-90fe8ecca40e", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: Signed\nSigning date: 10:18 PM 10/18/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 16/74\nFirst Seen In The Wild: 2024-10-24T11:39:46+00:00\nFirst Submission: 2024-10-23T18:41:33+00:00\nLast Submission: 2024-10-23T18:41:33+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "creation-time", "timestamp": "1784555438", "to_ids": false, "type": "datetime", "uuid": "7b751f01-94ec-4ccd-9f07-dae570e0f03d", "value": "2009-12-11T11:47:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "ssdeep", "timestamp": "1784555438", "to_ids": true, "type": "ssdeep", "uuid": "ff440f08-927b-487c-bb27-10f49479c0cf", "value": "786432:HX95YocYQIcbJ2XDree0XN+ZJ1W6p7cG67:NqcQTlomN+ZJ1z7cG6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555438", "to_ids": false, "type": "size-in-bytes", "uuid": "a4344595-92ee-42f3-b443-e77dab16f2eb", "value": "30929920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "vhash", "timestamp": "1784555438", "to_ids": true, "type": "vhash", "uuid": "2b6440a2-4400-4283-862c-dd77bdf5613e", "value": "a20b376e27b6e6af9c9776775d5814ec" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-23T18:41:33+00:00", "last_seen": "2024-10-23T18:41:33+00:00", "object_relation": "filename", "timestamp": "1784555438", "to_ids": true, "type": "filename", "uuid": "78a72fd2-b775-4711-bf24-827cc64a9dd8", "value": "lets--VPN.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557361", "uuid": "97c30f4b-f861-447b-8f2c-626361dd8037", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "md5", "timestamp": "1784557361", "to_ids": true, "type": "md5", "uuid": "a2c58544-62f6-4eab-a00c-82c0e744d43f", "value": "bd6653174c9db4e0463be98f5d74776b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "sha1", "timestamp": "1784557361", "to_ids": true, "type": "sha1", "uuid": "6cd6aaed-b8b5-445e-b4b9-cdd699aa4076", "value": "b300e81bf6675ae1c5fa96fd90e61a49d085790b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "sha256", "timestamp": "1784557361", "to_ids": true, "type": "sha256", "uuid": "952c1832-bae8-4a51-894d-650d62a3aebb", "value": "2aa1e16aa23bc394284d7d1bcebfbd553fabf0999c8221096bbebe60185f7ca7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "text", "timestamp": "1784555459", "to_ids": false, "type": "text", "uuid": "aac90ae4-1059-4a33-ad7f-617eb5401437", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: Signed\nSigning date: 06:52 AM 10/25/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 46/74\nFirst Submission: 2024-10-26T16:15:34+00:00\nLast Submission: 2024-11-12T18:48:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "creation-time", "timestamp": "1784555460", "to_ids": false, "type": "datetime", "uuid": "c22a4e6d-0925-4163-877e-f5e66f562f84", "value": "2051-09-01T07:31:04+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "ssdeep", "timestamp": "1784555459", "to_ids": true, "type": "ssdeep", "uuid": "ffc43d63-a4ed-4b49-809d-d40fb12a9f3d", "value": "768:d4EbvkA9r5Wm0HnaEsp2gQ4R/JpR2gQ4R/FPF2EDD:d4Hir8H+ptQo/JpRtQo/FPFND" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555459", "to_ids": false, "type": "size-in-bytes", "uuid": "35efa7a4-c880-4082-b212-9a890d5c741f", "value": "34344" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "vhash", "timestamp": "1784555459", "to_ids": true, "type": "vhash", "uuid": "cda2b2b1-afbb-4036-a4f2-5d9cb2adf2b6", "value": "23403655151160810a40026" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-26T16:15:34+00:00", "last_seen": "2024-11-12T18:48:59+00:00", "object_relation": "filename", "timestamp": "1784555459", "to_ids": true, "type": "filename", "uuid": "f8ce65fa-80ba-4afa-b0a4-42a0bb21774e", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557363", "uuid": "3f1c68ed-8a31-4cef-8c44-be76f382c0b0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "md5", "timestamp": "1784557362", "to_ids": true, "type": "md5", "uuid": "98060453-ffe8-4adc-adb0-e5865b47f662", "value": "46543a8b15c8b62bcc825d4248ab705b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "sha1", "timestamp": "1784557363", "to_ids": true, "type": "sha1", "uuid": "0f0b595e-d2fb-4e91-bb65-143dd9ef47b1", "value": "53529649dee6962601ea89c0dd794fdf9bf55eee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "sha256", "timestamp": "1784557363", "to_ids": true, "type": "sha256", "uuid": "3af2dddd-b9b1-4e0a-964f-82990062f024", "value": "2a1c29208a2acbc9306a3f726f07a1978bd13988fae71de0db78ef146e04e2d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "text", "timestamp": "1784555481", "to_ids": false, "type": "text", "uuid": "f8df87dd-489a-49cd-b261-1158cdd0c66c", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 03:14 PM 10/30/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: Win.Ransomware.Msilzilla-10014498-0\nVT Total Detection: 42/74\nFirst Submission: 2024-11-01T08:29:33+00:00\nLast Submission: 2024-11-05T01:42:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "creation-time", "timestamp": "1784555481", "to_ids": false, "type": "datetime", "uuid": "99204b93-e55f-4861-88a3-d7b29f28b3ca", "value": "2022-01-24T07:31:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "ssdeep", "timestamp": "1784555481", "to_ids": true, "type": "ssdeep", "uuid": "c2ba0f00-03a4-4367-aae5-7fa2c64d4ccb", "value": "12288:bGHCnaomAEg3uPdkgmX+tCx1ck/MMmOB4A+6wnCDrGG:bGHCm8uPdJGzMhOB4A+6iC+G" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555481", "to_ids": false, "type": "size-in-bytes", "uuid": "07864a37-5109-4b47-a045-5310d466d5c9", "value": "631776" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "vhash", "timestamp": "1784555481", "to_ids": true, "type": "vhash", "uuid": "9b81c767-fb84-4140-bb6c-fb56464b8d4f", "value": "065066655d1d15656az8d!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-01T08:29:33+00:00", "last_seen": "2024-11-05T01:42:18+00:00", "object_relation": "filename", "timestamp": "1784555481", "to_ids": true, "type": "filename", "uuid": "d583c42a-6b58-4039-9674-7c4b21026d3d", "value": "2a1c29208a2acbc9306a3f726f07a1978bd13988fae71de0db78ef146e04e2d1.exe.sample" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557364", "uuid": "f10e3c35-7441-4c8d-9f89-ab40655b675b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "md5", "timestamp": "1784557363", "to_ids": true, "type": "md5", "uuid": "2631b775-fb15-430e-a8d0-05ea9140b92b", "value": "8b8f0e477c4aa1d3602c88e1ad3d410f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "sha1", "timestamp": "1784557363", "to_ids": true, "type": "sha1", "uuid": "a8917c89-60c8-403e-849a-1dde0037971f", "value": "bb0be48d9ebf49b34c083968f8604abf4ea54a00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "sha256", "timestamp": "1784557364", "to_ids": true, "type": "sha256", "uuid": "e4285f93-7337-4055-a1aa-8c502b92cc5e", "value": "339a58bd483ea35b203afd710da61e3c96ae281ce5242b2ebbe8d72d7de550b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "text", "timestamp": "1784555503", "to_ids": false, "type": "text", "uuid": "82c3de2d-5534-417f-a3a9-71e318935e6f", "value": "Type Description: Win32 EXE\nOriginal name: 360zip.exe\nVerified: Signed\nSigning date: 03:51 PM 10/31/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2024-11-02T12:23:05+00:00\nLast Submission: 2025-01-25T20:05:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "creation-time", "timestamp": "1784555503", "to_ids": false, "type": "datetime", "uuid": "1506c32d-1a3d-4f11-b181-3871d49e9637", "value": "2024-10-31T15:48:40+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "ssdeep", "timestamp": "1784555503", "to_ids": true, "type": "ssdeep", "uuid": "474ef7fe-3fa9-43a8-8c46-2cbfea689584", "value": "24576:rLQKsIH+x3IzV29IXSxig6mXhBI7RMMleqopJUDzf045t6Jinl:rLQKYFQVkxigHXhBI7RMMleYXFfl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555503", "to_ids": false, "type": "size-in-bytes", "uuid": "5c3d95ce-ce71-430b-9f1e-a17ab4beec71", "value": "1741352" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "vhash", "timestamp": "1784555503", "to_ids": true, "type": "vhash", "uuid": "45be49ff-5dd3-43fe-91c0-7a682ca3c528", "value": "0160c6050d050505160dcz1!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-02T12:23:05+00:00", "last_seen": "2025-01-25T20:05:43+00:00", "object_relation": "filename", "timestamp": "1784555503", "to_ids": true, "type": "filename", "uuid": "1a4e0449-1513-4e31-a1b7-8f1e1a624a3a", "value": "360zip.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557365", "uuid": "1d040480-842b-4a4a-861d-3073f98a3c40", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "md5", "timestamp": "1784557365", "to_ids": true, "type": "md5", "uuid": "83c6e588-4b4c-421d-bcbb-4fda510a637f", "value": "0587fbd124aff114d91899e82a714555", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "sha1", "timestamp": "1784557365", "to_ids": true, "type": "sha1", "uuid": "a39263a8-b641-4bf0-8b83-3a657d9f3f52", "value": "bfb0d20fc82616f52dd9bb7513bb5f1ac281bda3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "sha256", "timestamp": "1784557365", "to_ids": true, "type": "sha256", "uuid": "ac9b71b8-63f1-47e4-9dae-cca3dcd9ca86", "value": "f010c0933d6347d3eb56feb2a52d10ba412f28a0c9d130c6fd5ac2068f3f64ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "text", "timestamp": "1784555524", "to_ids": false, "type": "text", "uuid": "fd787514-a241-4086-a515-c8363fa9c1da", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 07:44 AM 11/12/2024\nSigners: PrimeSnap Technologies Network Company; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2024-11-12T17:53:53+00:00\nLast Submission: 2025-01-09T02:39:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "creation-time", "timestamp": "1784555524", "to_ids": false, "type": "datetime", "uuid": "7081e3b0-983c-4cee-8ab2-b48fac3771ad", "value": "2018-12-15T22:26:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "ssdeep", "timestamp": "1784555524", "to_ids": true, "type": "ssdeep", "uuid": "a8de6839-5ef3-44af-b7d7-f85226849009", "value": "1572864:7Su/x6vSa4mq+0/03SZurRov2WS0SJwyQPYyJJzjiHYq:7Sx6r+EsrWW19QPrJzji9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555524", "to_ids": false, "type": "size-in-bytes", "uuid": "9c61d0b5-66c2-4904-a77f-3404773b4724", "value": "78245120" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "vhash", "timestamp": "1784555524", "to_ids": true, "type": "vhash", "uuid": "a660ef7f-5f59-475c-ab36-0224fe6c1471", "value": "077056655d1c0550d043z800417z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-12T17:53:53+00:00", "last_seen": "2025-01-09T02:39:46+00:00", "object_relation": "filename", "timestamp": "1784555524", "to_ids": true, "type": "filename", "uuid": "6f5fb018-81c8-4c9a-b38e-29defad2a427", "value": "Docusign setup 7.12.2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557366", "uuid": "f3817834-f2af-4e48-8db8-231023a9e918", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "md5", "timestamp": "1784557366", "to_ids": true, "type": "md5", "uuid": "d70044b2-752b-4fa0-8e61-89ef0a7aaed5", "value": "680023fb613cc5efe445a4b709380424", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "sha1", "timestamp": "1784557366", "to_ids": true, "type": "sha1", "uuid": "ecf974bf-d738-4d9b-aa11-fea44c8ca9a1", "value": "3c7d2cf88192ea62292dea1bf613cd91e67f8758", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "sha256", "timestamp": "1784557366", "to_ids": true, "type": "sha256", "uuid": "4445400b-3712-46d0-8020-47cf69cffdce", "value": "556ffc264ce75b87b7cbce1c39585b994ba232f2bf11277970dab92a3ecadc82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "text", "timestamp": "1784555546", "to_ids": false, "type": "text", "uuid": "f9177e05-0bd3-4c30-adbf-af4830fae1b4", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: Signed\nSigning date: 11:54 PM 11/20/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 42/74\nFirst Submission: 2024-12-02T13:40:18+00:00\nLast Submission: 2024-12-02T13:40:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "creation-time", "timestamp": "1784555546", "to_ids": false, "type": "datetime", "uuid": "3de476b9-985f-43ac-90ae-9ce504dfb1e0", "value": "2102-08-31T22:36:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "ssdeep", "timestamp": "1784555546", "to_ids": true, "type": "ssdeep", "uuid": "b8414a5d-3e18-474e-8856-14b410f7080c", "value": "12288:koFw247s4hsx6fvg6szJkBMf4eIMdJwE+eJVUfSLGUf1P3b9kHI6Ryq30RmNgM:hvQs4h46fTBMfOMdL+eJ4epk7RyDEN7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555546", "to_ids": false, "type": "size-in-bytes", "uuid": "167455a2-c275-483e-adba-d33042464c0b", "value": "704040" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "vhash", "timestamp": "1784555546", "to_ids": true, "type": "vhash", "uuid": "821819b0-0d56-4b3c-965f-21972f744291", "value": "275036751512f081363a10128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-02T13:40:18+00:00", "last_seen": "2024-12-02T13:40:18+00:00", "object_relation": "filename", "timestamp": "1784555546", "to_ids": true, "type": "filename", "uuid": "cc45d2fa-d935-4a3e-919f-17035675781a", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557368", "uuid": "f525b868-cf8c-4178-8004-b6a090b881d9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "md5", "timestamp": "1784557367", "to_ids": true, "type": "md5", "uuid": "45592274-547b-4cc2-890f-87d3349afe7d", "value": "c4efc23d6136ee2819944559cda1ff4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "sha1", "timestamp": "1784557368", "to_ids": true, "type": "sha1", "uuid": "1b5bb361-9e7e-42db-bb59-e2bacb9e5ef2", "value": "c56905d168f00a2de3f6c716910081295606e36e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "sha256", "timestamp": "1784557368", "to_ids": true, "type": "sha256", "uuid": "b4f9a161-f472-4821-8bbc-11a3dded0f12", "value": "d0ed36627f6e197d3296a101b9366508cd62254b34e1c38e1a879853b2cc6284", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "text", "timestamp": "1784555568", "to_ids": false, "type": "text", "uuid": "a55acad3-3dc5-46a1-b8e8-de24a70e0c53", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 05:44 AM 11/04/2024\nSigners: Portier Global Pty Ltd; SSL.com EV Code Signing Intermediate CA RSA R3; SSL.com EV Root Certification Authority RSA R2\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2024-12-12T07:59:32+00:00\nLast Submission: 2024-12-12T07:59:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "ssdeep", "timestamp": "1784555568", "to_ids": true, "type": "ssdeep", "uuid": "36e8244d-73b5-45fc-b3fe-e96093447cc4", "value": "196608:UZK3LIgwuV/1ENJ9a6zVjQNR2V14gfR9j+FUrheQ:cK3UgJV/1EJa6BjxlPjcchJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555568", "to_ids": false, "type": "size-in-bytes", "uuid": "8987a096-48d3-467c-b5c2-e51a869d8872", "value": "16103976" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "vhash", "timestamp": "1784555568", "to_ids": true, "type": "vhash", "uuid": "3d06080e-0ca8-4eb3-921a-aa941bf6cc09", "value": "0170f6655d55551555757az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-12T07:59:32+00:00", "last_seen": "2024-12-12T07:59:32+00:00", "object_relation": "filename", "timestamp": "1784555568", "to_ids": true, "type": "filename", "uuid": "fc33a868-26a5-433a-b88b-aa64f13c02b5", "value": "keyonthego-service.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557369", "uuid": "e4eedc16-a391-4cc8-9eef-9674cd04cacd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "md5", "timestamp": "1784557368", "to_ids": true, "type": "md5", "uuid": "b436933d-17c7-4af6-b60f-bf1c357b06f2", "value": "ed07884c273b610dcf6a7527653943a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "sha1", "timestamp": "1784557368", "to_ids": true, "type": "sha1", "uuid": "c83111e4-449d-47a2-8f47-1250e4924bcc", "value": "3ba5264597669f06eefd5c320bb145f8014d2472", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "sha256", "timestamp": "1784557369", "to_ids": true, "type": "sha256", "uuid": "6ce3fc4a-e5cb-47ef-b941-8800ee40b3cf", "value": "68d13e16f37d2207655b3cb00b1433532317045985d0e2f1f31d06fc19e76aeb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "text", "timestamp": "1784555589", "to_ids": false, "type": "text", "uuid": "a41395f7-78cd-442a-a546-5db2f91d18cb", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 04:43 AM 12/10/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2024-12-14T01:04:23+00:00\nLast Submission: 2024-12-14T01:04:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "creation-time", "timestamp": "1784555589", "to_ids": false, "type": "datetime", "uuid": "4ca90424-df30-4e55-a98a-e35ebb47d351", "value": "2024-11-12T06:24:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "ssdeep", "timestamp": "1784555589", "to_ids": true, "type": "ssdeep", "uuid": "24080ae3-1933-4bdf-8910-77e3c3612334", "value": "6144:pmeHjZoFFsr5GswcvXE6bXDBQFF4DvXtZiRp6g0orANJjm3EYZPt:MSjIFsY08MgwBJjct" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555589", "to_ids": false, "type": "size-in-bytes", "uuid": "636bedbc-c5f1-4cb1-aaa8-96f804849b26", "value": "290928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "vhash", "timestamp": "1784555589", "to_ids": true, "type": "vhash", "uuid": "937aa5c3-a412-4cca-aa7a-ab90dd4f5bba", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-14T01:04:23+00:00", "last_seen": "2024-12-14T01:04:23+00:00", "object_relation": "filename", "timestamp": "1784555589", "to_ids": true, "type": "filename", "uuid": "bedb34f0-1caf-41a2-a0c2-d56503488a0e", "value": "TASLoginBase.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557370", "uuid": "506b5307-6cfd-411b-9f9a-de37af178948", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "md5", "timestamp": "1784557370", "to_ids": true, "type": "md5", "uuid": "7b7dc7c9-4410-4604-a74c-c9b92de2fb62", "value": "1c3bacc49840d6027561dcdbdbdad848", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "sha1", "timestamp": "1784557370", "to_ids": true, "type": "sha1", "uuid": "1620b47f-e5fa-4e5a-b500-57b8c048a0b0", "value": "ed45cd0f45644a9a65b2a8dfc0f60c32c6aa5cf1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "sha256", "timestamp": "1784557370", "to_ids": true, "type": "sha256", "uuid": "93c75865-4dee-4a70-ab6a-fc03546cd206", "value": "fddf2280d11a4d3e7cbc692bc4c3a5a1c36406c6dbaf51c826d6a0c734abe107", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "text", "timestamp": "1784555611", "to_ids": false, "type": "text", "uuid": "af6efddc-95db-4dd7-8fbf-6935ae4e9867", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: Signed\nSigning date: 01:08 PM 12/16/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 45/74\nFirst Submission: 2024-12-17T09:07:42+00:00\nLast Submission: 2024-12-17T09:07:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "creation-time", "timestamp": "1784555611", "to_ids": false, "type": "datetime", "uuid": "5d78facd-99b0-4c2f-94e5-5352f8e327e5", "value": "2103-09-27T20:39:27+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "ssdeep", "timestamp": "1784555611", "to_ids": true, "type": "ssdeep", "uuid": "877acb5f-f86a-4160-af1e-64230fff700c", "value": "768:BzOuKmN5ZwzVfEsp2gQ4R/Gf2gQ4R/xfb2Ea:xOu9Nv2nptQo/GftQo/xTM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555611", "to_ids": false, "type": "size-in-bytes", "uuid": "e443380e-a5ff-4645-9e93-5ff6a06eabdc", "value": "34888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "vhash", "timestamp": "1784555611", "to_ids": true, "type": "vhash", "uuid": "cf9c36d0-20e4-413b-88e6-86500f6e03dc", "value": "23403655151190811d60026" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-17T09:07:42+00:00", "last_seen": "2024-12-17T09:07:42+00:00", "object_relation": "filename", "timestamp": "1784555611", "to_ids": true, "type": "filename", "uuid": "96a1eff6-0ca3-4f06-928d-1ba9e0476352", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557371", "uuid": "4f24e965-ddae-407b-951e-37bfdb970ee7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "md5", "timestamp": "1784557371", "to_ids": true, "type": "md5", "uuid": "ecf67ecd-5f88-411c-83c9-cae8b86eacf7", "value": "a4ec8941553ef6f1c87c7cda143a4362", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "sha1", "timestamp": "1784557371", "to_ids": true, "type": "sha1", "uuid": "f08d2c2d-ef2b-49f0-aaa9-e1460b914c66", "value": "bc83e9090cfe7606171389638aa177388090a4f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "sha256", "timestamp": "1784557371", "to_ids": true, "type": "sha256", "uuid": "1bdafcef-4c8f-4d02-afdc-6ca3f450b775", "value": "e77f4a5bb9b26124e0c7482e248c8af2cc5140d363208c8192aeec84ae829ef3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "text", "timestamp": "1784555632", "to_ids": false, "type": "text", "uuid": "0b161894-cae3-457d-9adf-b466121d48d9", "value": "Type Description: Win32 EXE\nOriginal name: \"ApplyTrustOffline.PROGRAM\"\nVerified: Signed\nSigning date: 11:18 PM 12/10/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 41/74\nFirst Submission: 2024-12-17T06:13:05+00:00\nLast Submission: 2024-12-17T06:13:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "creation-time", "timestamp": "1784555632", "to_ids": false, "type": "datetime", "uuid": "b27ee4a7-95a9-42b0-b234-36d696e1cb1e", "value": "2024-11-13T09:05:05+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "ssdeep", "timestamp": "1784555632", "to_ids": true, "type": "ssdeep", "uuid": "b3dbde6a-ed66-40a8-b881-c2a710fed446", "value": "6144:pkrXUmfi4lqOMHuJt2soL1e+DGkUZTNKIfuReJ0:+XTSKt2rLQjkgTHfy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555632", "to_ids": false, "type": "size-in-bytes", "uuid": "28d4ead6-e27f-454c-925b-3df9f3a0c563", "value": "242384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "vhash", "timestamp": "1784555632", "to_ids": true, "type": "vhash", "uuid": "fdc92c71-7311-4703-a595-2981dbfdfc50", "value": "225036651512e08b60800113" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-17T06:13:05+00:00", "last_seen": "2024-12-17T06:13:05+00:00", "object_relation": "filename", "timestamp": "1784555632", "to_ids": true, "type": "filename", "uuid": "48df5b82-c1d3-4b62-95c2-4bae484bc82c", "value": "\"ApplyTrustOffline.PROGRAM\"" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557373", "uuid": "12ba1e36-16df-4699-bd25-34be7920b497", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "md5", "timestamp": "1784557372", "to_ids": true, "type": "md5", "uuid": "f76a32e8-608c-4963-be83-c6979e20dc27", "value": "7635de345cffdad7f389640d982d2f50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "sha1", "timestamp": "1784557372", "to_ids": true, "type": "sha1", "uuid": "8cb8e864-12b3-43a4-aecb-4e3bf2bda69f", "value": "7990fee6e6fc351424cd616ff995321892a85a63", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "sha256", "timestamp": "1784557373", "to_ids": true, "type": "sha256", "uuid": "2b9fc775-510f-4c79-9c35-13e6d7dc7818", "value": "68ea314a0b8d20a02189f7c28b62a6db1badef9499a5d1a861a2f5364534a9da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "text", "timestamp": "1784555654", "to_ids": false, "type": "text", "uuid": "92865b21-9ad7-4636-8488-7e4c6c50b4c1", "value": "Type Description: Win32 DLL\nOriginal name: NAudio.WinForms.dll\nVerified: Signed\nSigning date: 08:00 AM 11/12/2024\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2024-12-20T12:19:01+00:00\nLast Submission: 2024-12-20T12:19:01+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "creation-time", "timestamp": "1784555654", "to_ids": false, "type": "datetime", "uuid": "b1c44ef1-6daa-4702-97d2-3f172de3b107", "value": "2070-08-12T21:29:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "ssdeep", "timestamp": "1784555654", "to_ids": true, "type": "ssdeep", "uuid": "e407bd75-dc08-4b20-84fa-44832fd0cc0f", "value": "768:fGRcd/kDtaV39ugB/0LPbWCPREb4DmHBRpme5JOr2JZaJS+ST6nk2:AaV39ug6yMOb4Dm1z+EaJ/mw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555654", "to_ids": false, "type": "size-in-bytes", "uuid": "d2034f18-f8d3-4a32-b480-98f01b2d1419", "value": "47480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "vhash", "timestamp": "1784555654", "to_ids": true, "type": "vhash", "uuid": "49ddd3e8-ce2f-43b6-91a6-a77530538523", "value": "344036551512d0813f2d665c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T12:19:01+00:00", "last_seen": "2024-12-20T12:19:01+00:00", "object_relation": "filename", "timestamp": "1784555654", "to_ids": true, "type": "filename", "uuid": "1693ce0e-7288-4e53-a5ed-f681dbf2f8e8", "value": "NAudio.WinForms.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557374", "uuid": "0eb7711a-a4f2-4e45-bfe6-9388b99fa0e4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "md5", "timestamp": "1784557373", "to_ids": true, "type": "md5", "uuid": "e1650fa0-1a96-4b10-bea0-24d0035f937b", "value": "778b6521dd2b07d7db0eaeaab9a2f86b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "sha1", "timestamp": "1784557373", "to_ids": true, "type": "sha1", "uuid": "8373a64d-de0c-4925-b1da-f8138e46426c", "value": "ce120e922ed4156dbd07de8335c5a632974ec527", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "sha256", "timestamp": "1784557374", "to_ids": true, "type": "sha256", "uuid": "872165ae-1dfa-4d09-a835-efa704152649", "value": "02244934046333f45bc22abe6185e6ddda033342836062afb681a583aa7d827f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "text", "timestamp": "1784555675", "to_ids": false, "type": "text", "uuid": "b9df275f-1b44-4888-b164-6dc9c23d2700", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: A certificate was explicitly revoked by its issuer.\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Malgent!MSR\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2024-12-20T15:14:58+00:00\nLast Submission: 2025-04-22T10:05:13+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "creation-time", "timestamp": "1784555675", "to_ids": false, "type": "datetime", "uuid": "28d97a06-8b67-47bc-a688-bc446c4a69e7", "value": "2057-01-19T14:33:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "ssdeep", "timestamp": "1784555675", "to_ids": true, "type": "ssdeep", "uuid": "5a1b4775-0e4f-4ec6-8cc9-197121a9779e", "value": "384:jQpiPp3ROTjkVcWHzjw/fdvmqrZhk3qc9cvVFC9S7AUGFRgQ4Ki6YhOnPQ4Ki6Yj:jsiBQjgnAxZtA9pjEQ4R/hePQ4R/pd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555675", "to_ids": false, "type": "size-in-bytes", "uuid": "a3127b03-d7b1-48c8-a372-780868cface3", "value": "25864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "vhash", "timestamp": "1784555675", "to_ids": true, "type": "vhash", "uuid": "bd9c26a5-b3fb-4e97-a60e-d717f5904d5a", "value": "2240365515118088d60020" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T15:14:58+00:00", "last_seen": "2025-04-22T10:05:13+00:00", "object_relation": "filename", "timestamp": "1784555675", "to_ids": true, "type": "filename", "uuid": "8fc93791-4507-442f-ac1d-440a37ceb969", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557374", "uuid": "cdc46af4-8a78-4b7b-bab4-d10b35103d84", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "md5", "timestamp": "1784557374", "to_ids": true, "type": "md5", "uuid": "785c329a-8758-448b-981b-4ad485345bf1", "value": "777bcf5a44203798fc1b1c33fdd1d89b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "sha1", "timestamp": "1784557374", "to_ids": true, "type": "sha1", "uuid": "bc8a7fce-d186-4f49-8855-baed9d1246c5", "value": "065acd4a5682d4f53032e0d45ffd0076af347cd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "sha256", "timestamp": "1784557374", "to_ids": true, "type": "sha256", "uuid": "3718e56e-f2ba-4cc1-8206-db981750d99b", "value": "45df85694d6bf2587e4dc2f30d391f00d98690850c46e210aa56ef2a1cbad4ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "text", "timestamp": "1784555697", "to_ids": false, "type": "text", "uuid": "a46ab130-706e-4661-9400-ea76d7365d58", "value": "Type Description: Win32 DLL\nVerified: A certificate was explicitly revoked by its issuer.\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2024-12-20T07:28:45+00:00\nLast Submission: 2024-12-20T07:28:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "creation-time", "timestamp": "1784555697", "to_ids": false, "type": "datetime", "uuid": "7097b2e0-dd6f-46be-8857-99fda5ebeb99", "value": "2024-12-20T06:42:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "ssdeep", "timestamp": "1784555697", "to_ids": true, "type": "ssdeep", "uuid": "191ed2dc-a859-4b7e-915b-2abe0f5ff39d", "value": "1536:Gpay1f532W9I7h+gCnH/RXynozl3ZL1sWAcdbjGVD2FAZ3MQo/h1hBQo/pMG:0ay/m2spCnH/RHl3ZpbjGVDkAZ8QOzht" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555697", "to_ids": false, "type": "size-in-bytes", "uuid": "4ea79be1-6108-4168-bec9-9e7c0d915911", "value": "87304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "vhash", "timestamp": "1784555697", "to_ids": true, "type": "vhash", "uuid": "ceb7aeb7-87b7-4f1c-84ea-3f9862115890", "value": "184046655d156az41?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-20T07:28:45+00:00", "last_seen": "2024-12-20T07:28:45+00:00", "object_relation": "filename", "timestamp": "1784555697", "to_ids": true, "type": "filename", "uuid": "2531e09f-ef70-4745-9409-3994d78dfdfa", "value": "TASLoginBase.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557376", "uuid": "c17d104c-8907-4269-b494-2bfc6e3844c4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "md5", "timestamp": "1784557376", "to_ids": true, "type": "md5", "uuid": "b3ce3027-f429-4932-8d6a-fb01608d063b", "value": "714d2832c2bfa7ed4309edf3e0629839", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "sha1", "timestamp": "1784557376", "to_ids": true, "type": "sha1", "uuid": "f7b0bbb7-20d0-45e3-94e9-c8390e383d2c", "value": "f1ccb000057819e8f40c59265a535d1a7c4771fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "sha256", "timestamp": "1784557376", "to_ids": true, "type": "sha256", "uuid": "0efd0c2f-4ea5-4f5c-a6d8-97d74d202311", "value": "5f422be165e4b6557f45719914f724a4fe1840fa792ecc739861bfdba45c1550", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "text", "timestamp": "1784555718", "to_ids": false, "type": "text", "uuid": "456559e4-0bed-4c73-b1b9-af8366f396e6", "value": "Type Description: Win32 EXE\nOriginal name: downloader\nVerified: Signed\nSigning date: 09:20 AM 12/23/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Malgent!MSR\nClamAV: None\nVT Total Detection: 47/74\nFirst Submission: 2025-01-07T15:19:15+00:00\nLast Submission: 2025-01-08T23:26:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "creation-time", "timestamp": "1784555718", "to_ids": false, "type": "datetime", "uuid": "a0a4f41b-fbe6-4992-8cd7-39e1b9bb24e4", "value": "2023-03-09T14:16:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "ssdeep", "timestamp": "1784555718", "to_ids": true, "type": "ssdeep", "uuid": "8e540692-e570-49a7-bc79-950d3ad2c232", "value": "1536:R61210i+0kXWIrk5cE/+4O8hSE43CjZdptQo/JvptQo/VK3hR:R68KijBIrk9/+4O8hSE43uZLtQO5ptQp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555718", "to_ids": false, "type": "size-in-bytes", "uuid": "e53782cd-e225-410c-a520-1a089e300395", "value": "88640" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "vhash", "timestamp": "1784555718", "to_ids": true, "type": "vhash", "uuid": "e12b6460-82aa-49d5-ad9e-91b73f52e544", "value": "28403655551160981161021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-07T15:19:15+00:00", "last_seen": "2025-01-08T23:26:11+00:00", "object_relation": "filename", "timestamp": "1784555718", "to_ids": true, "type": "filename", "uuid": "9ba868d2-dfa1-4ea9-b3d0-f6d60f575b5c", "value": "downloader" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557377", "uuid": "00a26daf-9be0-4045-a0f9-2f5e2c3ad70c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "md5", "timestamp": "1784557377", "to_ids": true, "type": "md5", "uuid": "dca6c91a-ec37-48bb-a910-0838d8b05d3f", "value": "4a01546af9c94d619eba01f6f5433aee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "sha1", "timestamp": "1784557377", "to_ids": true, "type": "sha1", "uuid": "9d4662e4-cf64-4219-af80-ff3e4e8dbd95", "value": "e0b180f594acddd6436feaadc5ff63e4085473c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "sha256", "timestamp": "1784557377", "to_ids": true, "type": "sha256", "uuid": "69775f67-612c-4b14-b7a2-6f8780dbfe9e", "value": "e46779869c6797b294cb097f47027a5c52466fd11112b6ccd52c569578d4b8cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "text", "timestamp": "1784555740", "to_ids": false, "type": "text", "uuid": "9b4ee2a1-ad7e-42da-9bfd-4f615e8e72fe", "value": "Type Description: Win32 EXE\nOriginal name: downloader\nVerified: Signed\nSigning date: 10:22 AM 12/24/2024\nSigners: Morning Leap & Cazo Electronics Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Malgent!MSR\nClamAV: None\nVT Total Detection: 46/74\nFirst Submission: 2025-01-07T15:19:10+00:00\nLast Submission: 2025-01-08T23:26:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "creation-time", "timestamp": "1784555740", "to_ids": false, "type": "datetime", "uuid": "d7e4dadb-2396-40ba-b579-84de916137de", "value": "2023-03-09T14:16:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "ssdeep", "timestamp": "1784555740", "to_ids": true, "type": "ssdeep", "uuid": "729406e2-8b28-463c-aa1c-d71cca156c82", "value": "768:GeihCZRv1EbcEsyQ4R/N+rQ4R/50m02Ed:khcRv1cIyQo/N+rQo/50m0f" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555740", "to_ids": false, "type": "size-in-bytes", "uuid": "7504b535-bd2c-44ed-9550-ade1a5c8cdd6", "value": "37488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "vhash", "timestamp": "1784555740", "to_ids": true, "type": "vhash", "uuid": "66757bae-f9e2-4908-b622-bc571e58f909", "value": "2340365555118088d60021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-07T15:19:10+00:00", "last_seen": "2025-01-08T23:26:05+00:00", "object_relation": "filename", "timestamp": "1784555740", "to_ids": true, "type": "filename", "uuid": "f8b13574-eb9d-49f7-8a19-2012dd4531b3", "value": "downloader" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557378", "uuid": "fd808b70-849f-4eaf-814f-4ab10c251b72", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "md5", "timestamp": "1784557378", "to_ids": true, "type": "md5", "uuid": "b259baa5-345d-4133-a33d-39a0836793e8", "value": "bb90d9573cec55aa56fd1196b55a793b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "sha1", "timestamp": "1784557378", "to_ids": true, "type": "sha1", "uuid": "b77df18e-48b8-4a5f-937f-4f548b343a1e", "value": "60265f79b0ab392e2ae747a6431f7e92f23cfe9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "sha256", "timestamp": "1784557378", "to_ids": true, "type": "sha256", "uuid": "7b038d12-a14b-4513-8b49-3652b638f3c7", "value": "0663da643bfff1565d8a7a2c016c36d7c75fc2cc9328862000a0b4e19c1763ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "text", "timestamp": "1784555762", "to_ids": false, "type": "text", "uuid": "bbcef2d0-a894-4b3a-955f-7d2fce275251", "value": "Type Description: Win32 DLL\nOriginal name: Spire.Doc.dll\nVerified: Signed\nSigning date: 02:24 AM 01/02/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-01-25T10:50:03+00:00\nLast Submission: 2025-01-25T10:50:03+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "creation-time", "timestamp": "1784555762", "to_ids": false, "type": "datetime", "uuid": "94ea336d-5870-4758-8d9f-45e7ca09b6b5", "value": "2024-02-22T03:24:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "ssdeep", "timestamp": "1784555762", "to_ids": true, "type": "ssdeep", "uuid": "eb430a89-ece8-426e-b2c1-6ecbcddf057d", "value": "98304:7059rRXX/nzBIFTiWYRnGkDWDCBxAmf81amtF3M5Abk7OvxB/p0V8ey3v4L4j:459rJzyFTiW8nGkDWDCBxXfOaGB2jjK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555762", "to_ids": false, "type": "size-in-bytes", "uuid": "b6d6ea6b-c501-4019-bd4d-b60d1226de98", "value": "18456440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "vhash", "timestamp": "1784555762", "to_ids": true, "type": "vhash", "uuid": "64f2ea94-0cc8-41ec-8340-31fa014ffe48", "value": "31703665151532e41ffffd92cff" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-25T10:50:03+00:00", "last_seen": "2025-01-25T10:50:03+00:00", "object_relation": "filename", "timestamp": "1784555762", "to_ids": true, "type": "filename", "uuid": "2c90dcc8-4693-4613-92ff-fe62314f516a", "value": "Spire.Doc.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557380", "uuid": "40220039-9127-4a5a-ba61-a3270bdddaea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "md5", "timestamp": "1784557380", "to_ids": true, "type": "md5", "uuid": "ce800d3e-05b7-4831-b699-97b28811129e", "value": "2b5d3ebe9babd38d4bba1e65ec1f45c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "sha1", "timestamp": "1784557380", "to_ids": true, "type": "sha1", "uuid": "228bb979-4394-44a8-8d01-414d912c3288", "value": "23b9505431fd3d5923a3744b2756c28f18f4e3cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "sha256", "timestamp": "1784557380", "to_ids": true, "type": "sha256", "uuid": "3588f30f-30b8-4125-a3c9-f64952b67451", "value": "88ff6f37f20bb5bd1637ef64306310c88ab949f8ee1569b9ec2da88c8e1759c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "text", "timestamp": "1784555784", "to_ids": false, "type": "text", "uuid": "4df74173-95ae-4e19-bce3-5830464da1ae", "value": "Type Description: Win32 EXE\nOriginal name: GetWordSearch.exe\nVerified: The digital signature of the object did not verify.\nSigning date: 02:37 PM 02/20/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2025-02-20T15:55:17+00:00\nLast Submission: 2025-08-06T09:38:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "creation-time", "timestamp": "1784555784", "to_ids": false, "type": "datetime", "uuid": "56cc37c4-e2ed-4eee-ad04-6d07137a21d5", "value": "2025-02-17T12:00:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "ssdeep", "timestamp": "1784555784", "to_ids": true, "type": "ssdeep", "uuid": "ea677b7a-a5e2-49fe-a459-2be0ef94f54e", "value": "1536:kzXxX32xuaNw570XBWuoom7Yy8KikK7qnsu/OYaR4a6fto6XsDE1YwBSCA3FXwNi:W32tXXKy3eN/z6ra8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555784", "to_ids": false, "type": "size-in-bytes", "uuid": "e3c52596-e650-4730-8013-128ab9ba20c2", "value": "148728" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "vhash", "timestamp": "1784555784", "to_ids": true, "type": "vhash", "uuid": "cd5fd24e-91ef-446e-b9b6-0faf2895b546", "value": "2150365515118088d60021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T15:55:17+00:00", "last_seen": "2025-08-06T09:38:47+00:00", "object_relation": "filename", "timestamp": "1784555784", "to_ids": true, "type": "filename", "uuid": "036cd621-2eb8-46f6-b160-926bd00630f6", "value": "GetWordSearch.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557382", "uuid": "350797d4-6922-4438-a963-83ca92ff02d8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "md5", "timestamp": "1784557382", "to_ids": true, "type": "md5", "uuid": "b74e27b5-d1e9-49db-b453-6474dfe571d6", "value": "48d760347daa6bd514fcd6b374adba00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "sha1", "timestamp": "1784557382", "to_ids": true, "type": "sha1", "uuid": "0005b997-50e8-41e4-b278-bd805a1695f6", "value": "3483b1a4152b553639c1595451924c4e3d8a84ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "sha256", "timestamp": "1784557382", "to_ids": true, "type": "sha256", "uuid": "ca98923f-e319-430a-aa14-3cfb8c3d0f2b", "value": "10cf2df8f655127d0935dc56bcd1222ea5c9e84cd7cf36285352ddf9122b5f38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "text", "timestamp": "1784555805", "to_ids": false, "type": "text", "uuid": "f26b289f-db02-43b1-b977-0c815353ac78", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 08:17 PM 02/19/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2025-02-20T16:03:38+00:00\nLast Submission: 2025-02-27T08:01:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "creation-time", "timestamp": "1784555806", "to_ids": false, "type": "datetime", "uuid": "aadee225-1dc4-4b0e-ac6a-427954de935c", "value": "2024-12-25T17:22:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "ssdeep", "timestamp": "1784555805", "to_ids": true, "type": "ssdeep", "uuid": "9ad7876b-afa6-4928-8daf-96e3a5ad6da5", "value": "3072:rz+O6+PopS3X6N7pvP3+uo0I6wocB1INi+jVjgHvWd65E62:rz9NPopSH6PvP3o9ocjRXudpt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555805", "to_ids": false, "type": "size-in-bytes", "uuid": "71a1d0b4-31f3-45c3-a829-a243442a98be", "value": "291360" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "vhash", "timestamp": "1784555805", "to_ids": true, "type": "vhash", "uuid": "142f79e0-c0ce-4d76-8529-27441fc5952d", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T16:03:38+00:00", "last_seen": "2025-02-27T08:01:47+00:00", "object_relation": "filename", "timestamp": "1784555805", "to_ids": true, "type": "filename", "uuid": "782d643d-0867-4d36-9360-5ceff2ac0ede", "value": "10cf2df8f655127d0935dc56bcd1222ea5c9e84cd7cf36285352ddf9122b5f38.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557384", "uuid": "3d657802-a50d-468d-bb1c-a3eb8a1810e5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "md5", "timestamp": "1784557383", "to_ids": true, "type": "md5", "uuid": "83533656-20da-4725-af9a-adcc0d0835da", "value": "1adb14dfff983d8798a2e9f75c2e7615", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "sha1", "timestamp": "1784557383", "to_ids": true, "type": "sha1", "uuid": "1186105a-2bfa-432a-8e8a-0109862d8f71", "value": "d2d22da7f1c569b06cc01bbd9fae8e143ad614b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "sha256", "timestamp": "1784557384", "to_ids": true, "type": "sha256", "uuid": "458e2db8-71f2-4285-aa53-46db3c9409bd", "value": "71181867d6e45cd80627938e25da05382964e05db70de9087dc9e06f10a64bcf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "text", "timestamp": "1784555827", "to_ids": false, "type": "text", "uuid": "f4ac1d85-0a6c-4691-8a65-9c4b73c8de76", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: Signed\nSigning date: 01:29 PM 02/19/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Jalapeno.AVN!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2025-02-20T03:11:00+00:00\nLast Submission: 2025-02-20T14:14:57+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "creation-time", "timestamp": "1784555827", "to_ids": false, "type": "datetime", "uuid": "f8797212-5f15-4a3b-9c2f-c523e6fc3d5c", "value": "2098-09-27T09:41:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "ssdeep", "timestamp": "1784555827", "to_ids": true, "type": "ssdeep", "uuid": "1f0ad634-40c0-4009-97ce-2096cd1f0082", "value": "384:zrvzfoVRJgVwLwJqRUdjq8srYExzLOerKNyb8E9VFzSJIVYKQxizogy5/5NKQxie:zPoVK0TN5tz7KEsFL4YL4G2E6q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555827", "to_ids": false, "type": "size-in-bytes", "uuid": "2ae14f8c-f66f-4432-94bd-f6783611aa89", "value": "31304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "vhash", "timestamp": "1784555827", "to_ids": true, "type": "vhash", "uuid": "cb73148d-7a8a-4102-992c-3bccdbd46472", "value": "23403655151170811d40026" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-20T03:11:00+00:00", "last_seen": "2025-02-20T14:14:57+00:00", "object_relation": "filename", "timestamp": "1784555827", "to_ids": true, "type": "filename", "uuid": "5a9c9f81-581a-4e57-b66d-68b42b308b0d", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557385", "uuid": "3d9ce2a2-4027-4976-9853-128eb459a368", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "md5", "timestamp": "1784557385", "to_ids": true, "type": "md5", "uuid": "d17fb5a2-c7ec-47bb-a833-1b53116d9364", "value": "70c33496a75a69d5c9f042423fd637f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "sha1", "timestamp": "1784557385", "to_ids": true, "type": "sha1", "uuid": "5a70ac8b-cc80-4120-a781-c146b4d8bbcb", "value": "8123dc13105129f8e862b6f295543457f892faa3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "sha256", "timestamp": "1784557385", "to_ids": true, "type": "sha256", "uuid": "d1f6d590-a2dc-444d-a759-600486b8bf72", "value": "d95f631c18ecf494d8cd1c65118355ef8994854b826f914714ac74a5fbdab3ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "text", "timestamp": "1784555848", "to_ids": false, "type": "text", "uuid": "b9f9f9c4-eb30-4e6e-a9a6-64494ae29981", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 10:21 PM 02/20/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2025-02-21T15:55:49+00:00\nLast Submission: 2025-02-27T08:01:38+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "creation-time", "timestamp": "1784555848", "to_ids": false, "type": "datetime", "uuid": "e086d48f-fda1-4cb8-ab6c-82eaa281241f", "value": "2025-02-15T19:49:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "ssdeep", "timestamp": "1784555848", "to_ids": true, "type": "ssdeep", "uuid": "f17e66b4-e141-44a7-a6e4-af6993b657a7", "value": "6144:W4FXP53GIck/rVfuulS6Erw/3HtPIPDzpk4lIZfzsZwv:PLfHtEeZfz9v" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555848", "to_ids": false, "type": "size-in-bytes", "uuid": "14a87476-f4e1-484b-8f99-d49780a1d22b", "value": "214088" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "vhash", "timestamp": "1784555848", "to_ids": true, "type": "vhash", "uuid": "c1381450-c24f-4ca3-8c43-b7dfa69e9b1c", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T15:55:49+00:00", "last_seen": "2025-02-27T08:01:38+00:00", "object_relation": "filename", "timestamp": "1784555848", "to_ids": true, "type": "filename", "uuid": "14552161-95e1-4943-8118-f5df0bc1ef54", "value": "d95f631c18ecf494d8cd1c65118355ef8994854b826f914714ac74a5fbdab3ea.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557387", "uuid": "3ad44828-60d1-412d-80c7-485fcafd207f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "md5", "timestamp": "1784557386", "to_ids": true, "type": "md5", "uuid": "23c925bd-dadb-4ea8-8895-314efc860584", "value": "084127bd75c5ef420b79986f771e1e8e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "sha1", "timestamp": "1784557386", "to_ids": true, "type": "sha1", "uuid": "6bf4adf5-7def-4f19-8219-7a73e8be1395", "value": "c91c161d8eee2c930a89011625fa386179ecc464", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "sha256", "timestamp": "1784557387", "to_ids": true, "type": "sha256", "uuid": "465c06df-1079-4022-960f-79dc92fd13e4", "value": "fe14cc6fb83af99493d48119106fd83d4288292eada0e76526c1ac636e94e45e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "text", "timestamp": "1784555870", "to_ids": false, "type": "text", "uuid": "727fa070-08b9-4d97-92d4-a76c97db30df", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 07:10 PM 02/21/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2025-02-21T20:10:48+00:00\nLast Submission: 2025-02-27T08:00:48+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "creation-time", "timestamp": "1784555870", "to_ids": false, "type": "datetime", "uuid": "9d6abfa7-af42-4a1c-87f8-4026866ee20b", "value": "2024-12-25T17:22:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "ssdeep", "timestamp": "1784555870", "to_ids": true, "type": "ssdeep", "uuid": "a9fb99b4-8611-4f1f-9408-4fbbc4464484", "value": "3072:Y3whOCAcdF0LzZpFGSLjZ1JrhIcCd1hyyVJJ1PGR:hhOncYRpFGSnVhIN1I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555870", "to_ids": false, "type": "size-in-bytes", "uuid": "971351fb-fc50-4835-b113-c3ee11c6afc1", "value": "193728" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "vhash", "timestamp": "1784555870", "to_ids": true, "type": "vhash", "uuid": "2f615942-411d-424d-b070-d3c94e8ac350", "value": "115066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T20:10:48+00:00", "last_seen": "2025-02-27T08:00:48+00:00", "object_relation": "filename", "timestamp": "1784555870", "to_ids": true, "type": "filename", "uuid": "072cbe9a-21b9-45f1-8ca8-7c647d87201d", "value": "fe14cc6fb83af99493d48119106fd83d4288292eada0e76526c1ac636e94e45e.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557388", "uuid": "ded5b53c-3076-4160-9bf0-88d47895e625", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "md5", "timestamp": "1784557388", "to_ids": true, "type": "md5", "uuid": "cbce236c-7671-4998-b729-d0033af55e87", "value": "789575d3b211644cc7c10511d8c521aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "sha1", "timestamp": "1784557388", "to_ids": true, "type": "sha1", "uuid": "24ff2cab-0d60-4867-9e1d-0809b4e164e0", "value": "8a9316ce977f2cda80ca50d93b4ab1569e1b5607", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "sha256", "timestamp": "1784557388", "to_ids": true, "type": "sha256", "uuid": "11607e4a-11d0-48b3-9e19-e8c7ea70bf32", "value": "a94557f95b524cc5ac14721160121cd506f5902f570d2f26e54430b035d1a75b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "text", "timestamp": "1784555891", "to_ids": false, "type": "text", "uuid": "8c8d9bf2-6977-41ee-ac32-2a3810bf5712", "value": "Type Description: Win32 EXE\nOriginal name: chrome_proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 10:17 PM 02/20/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Noswk.PGN!MTB\nClamAV: None\nVT Total Detection: 42/74\nFirst Submission: 2025-02-21T15:48:39+00:00\nLast Submission: 2025-02-21T15:48:39+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "creation-time", "timestamp": "1784555891", "to_ids": false, "type": "datetime", "uuid": "77be7dc6-24e9-4755-8c50-dfb60a57a4a3", "value": "2025-02-18T03:57:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "ssdeep", "timestamp": "1784555891", "to_ids": true, "type": "ssdeep", "uuid": "1833ad2f-4e4a-47fd-8713-45ce0f9ae7ca", "value": "384:nPUOwL7nttgliUeL/XqRUdjq8srZqE5zLO1YB75Nyb8E9VF6IYijSJIVrlqXdEmH:9wXtcaSN5ZPz7ddEpYi6CgsL4+2EnE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555891", "to_ids": false, "type": "size-in-bytes", "uuid": "94b8091d-384f-4f79-aae8-8236448faa44", "value": "33568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "vhash", "timestamp": "1784555891", "to_ids": true, "type": "vhash", "uuid": "9c8a9a95-fd96-4be1-a260-576b20dcab2c", "value": "23403655551190811d60027" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T15:48:39+00:00", "last_seen": "2025-02-21T15:48:39+00:00", "object_relation": "filename", "timestamp": "1784555891", "to_ids": true, "type": "filename", "uuid": "982a007b-7a89-4e73-9e0a-0f6fd3f60ba0", "value": "chrome_proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557390", "uuid": "96b636a3-033a-4eca-9063-4fbb97b8a0be", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "md5", "timestamp": "1784557390", "to_ids": true, "type": "md5", "uuid": "d940cc21-983d-4574-85b5-615d032bbc16", "value": "df2d1351e1d110080cbd82fa72ede738", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "sha1", "timestamp": "1784557390", "to_ids": true, "type": "sha1", "uuid": "17f13bfb-863e-49dc-8d9f-a108b55f6b89", "value": "2453f3a9e262ee4e451e5d2838368a0ed72ae4da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "sha256", "timestamp": "1784557390", "to_ids": true, "type": "sha256", "uuid": "a53c271b-bcf4-451e-afa4-576e72fa25f1", "value": "3a338725967f6bb7fc3d5245bc40371742f46caae99f0db23e52f81c748091ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "text", "timestamp": "1784555912", "to_ids": false, "type": "text", "uuid": "783e046e-48db-42c3-82c7-4041db5f34f8", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 05:34 PM 02/20/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2025-02-22T00:39:30+00:00\nLast Submission: 2025-02-22T00:39:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "creation-time", "timestamp": "1784555913", "to_ids": false, "type": "datetime", "uuid": "652d54c0-4716-4948-8de4-33ead055f5a5", "value": "2025-02-15T19:49:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "ssdeep", "timestamp": "1784555913", "to_ids": true, "type": "ssdeep", "uuid": "b2660e8b-92ad-4cba-a605-3850655fc7f3", "value": "3072:uA8wHOkyXjym1O8KQCMXFk8a3rxaDK08aSKpW1vXkDjRpASiRMOnGTVKY31GxJjI:6DkI1YqD8SiowrTg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555913", "to_ids": false, "type": "size-in-bytes", "uuid": "b5be5df1-d5a0-4673-8873-afda56e7f092", "value": "240712" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "vhash", "timestamp": "1784555913", "to_ids": true, "type": "vhash", "uuid": "84a41be4-c494-4681-b187-a70ed9fc2f5e", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-22T00:39:30+00:00", "last_seen": "2025-02-22T00:39:30+00:00", "object_relation": "filename", "timestamp": "1784555913", "to_ids": true, "type": "filename", "uuid": "6d0805c9-c3d8-4eff-8bd9-3cf888e54220", "value": "2453f3a9e262ee4e451e5d2838368a0ed72ae4da.bin" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557392", "uuid": "02a90404-ad48-49a2-a877-c25bb154b888", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "md5", "timestamp": "1784557392", "to_ids": true, "type": "md5", "uuid": "f2076da1-36ce-4585-a735-a9f7deafb968", "value": "9fd172e43ccf1ca232596e5550b8e69b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "sha1", "timestamp": "1784557392", "to_ids": true, "type": "sha1", "uuid": "111499d6-bc54-4cc4-b263-40b1f331d979", "value": "529f9884b4a3c94f5ef13525bd9efb4950aafb84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "sha256", "timestamp": "1784557392", "to_ids": true, "type": "sha256", "uuid": "b5afbc44-ca7f-4947-b1b0-23c3cfe99531", "value": "5f347210ec34112a8f67ca2ccc10e70cff3da64a267375d954f48a7a12c33da5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "text", "timestamp": "1784555934", "to_ids": false, "type": "text", "uuid": "f3412d69-327c-4793-b54e-62cea675d517", "value": "Type Description: Win32 EXE\nOriginal name: GetWordSearch.exe\nVerified: The digital signature of the object did not verify.\nSigning date: 10:16 PM 02/19/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Noswk.PGN!MTB\nClamAV: None\nVT Total Detection: 39/74\nFirst Submission: 2025-02-23T07:04:09+00:00\nLast Submission: 2025-08-06T09:35:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "creation-time", "timestamp": "1784555934", "to_ids": false, "type": "datetime", "uuid": "8222bd17-9c07-4e4a-b094-c70012539181", "value": "2025-02-17T12:00:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "ssdeep", "timestamp": "1784555934", "to_ids": true, "type": "ssdeep", "uuid": "b87a51d0-8204-4e74-92fa-7b35d9e9bc3c", "value": "1536:9T5SNvlNw570XBWuoom7Yy8KikK7qnsu/OYaR4a6fto6XsDE1YwBSCAgFXwN/mat:99SNvlXXKygeN/z6mj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555934", "to_ids": false, "type": "size-in-bytes", "uuid": "a60ee794-ece6-4e3f-b3f6-1983e4e02a13", "value": "142584" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "vhash", "timestamp": "1784555934", "to_ids": true, "type": "vhash", "uuid": "c4bd03c8-ad14-4efa-8285-87059bc120d2", "value": "21503655151190811d60027" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T07:04:09+00:00", "last_seen": "2025-08-06T09:35:59+00:00", "object_relation": "filename", "timestamp": "1784555934", "to_ids": true, "type": "filename", "uuid": "0f67a6fc-e238-4369-a28b-5bb44af91825", "value": "GetWordSearch.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557395", "uuid": "3f0d81f9-c49f-412a-ae06-383da6a9c597", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "md5", "timestamp": "1784557394", "to_ids": true, "type": "md5", "uuid": "4402c7c4-e5b4-4425-98da-694d5eab7885", "value": "6807567619a42fef4b76a80bbafcf274", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "sha1", "timestamp": "1784557394", "to_ids": true, "type": "sha1", "uuid": "8f5db9dc-6bc6-4eb7-9623-350e556f655c", "value": "459df6708956e1ee20efb505fdd62f7a0d5b5373", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "sha256", "timestamp": "1784557395", "to_ids": true, "type": "sha256", "uuid": "2aa54bd0-be1e-4d2d-80c8-f37b653a72d7", "value": "dd68771f1ec87378a3d5e289ef70f51950471ca2edab05c72380a6ada7f7a2b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "text", "timestamp": "1784555955", "to_ids": false, "type": "text", "uuid": "52407221-dd7c-4f1d-ac87-4158b06f4a59", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 02:51 PM 02/22/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 15/74\nFirst Submission: 2025-02-23T01:48:59+00:00\nLast Submission: 2025-02-27T08:00:58+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "creation-time", "timestamp": "1784555955", "to_ids": false, "type": "datetime", "uuid": "f670e537-2e7e-4534-b55b-bbf70a2250b0", "value": "2024-12-25T17:22:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "ssdeep", "timestamp": "1784555955", "to_ids": true, "type": "ssdeep", "uuid": "66c0830e-a3bf-461a-9d72-3250ffa1f031", "value": "3072:I3whOCAcdF0LzZpFGSLjZ1JrhIcCd1hyyVJJ1BQV:RhOncYRpFGSnVhIN1u" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555955", "to_ids": false, "type": "size-in-bytes", "uuid": "7cee634b-7686-4bb6-85ad-a75c39299a17", "value": "202312" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "vhash", "timestamp": "1784555955", "to_ids": true, "type": "vhash", "uuid": "3a47dceb-47ab-4ed4-b589-026b760ed45e", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T01:48:59+00:00", "last_seen": "2025-02-27T08:00:58+00:00", "object_relation": "filename", "timestamp": "1784555955", "to_ids": true, "type": "filename", "uuid": "486f86a3-0898-41a4-be11-8b6ba956a0e8", "value": "dd68771f1ec87378a3d5e289ef70f51950471ca2edab05c72380a6ada7f7a2b3.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557396", "uuid": "c489e408-5082-4d6b-b233-f6fb584b8b7a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "md5", "timestamp": "1784557395", "to_ids": true, "type": "md5", "uuid": "377d2fbe-71ab-4846-bbf1-9ac6ccc02113", "value": "253375e0bf0960a63dd93331fc14282c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "sha1", "timestamp": "1784557395", "to_ids": true, "type": "sha1", "uuid": "bae66aec-b52b-40f1-a842-a84210e3109b", "value": "0142091a2a9b1d4e62e84a4ab1bb064b43989be1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "sha256", "timestamp": "1784557396", "to_ids": true, "type": "sha256", "uuid": "c26b6c6c-76e7-403c-86c9-d46cf40f35ed", "value": "e444f9d2d9744342cbca9313497c3a9ffb4e35499d0a4f6bd56925ea62b5b7ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "text", "timestamp": "1784555977", "to_ids": false, "type": "text", "uuid": "860a2b1a-fccd-4383-8851-e0a6e380f5cd", "value": "Type Description: Win32 EXE\nOriginal name: SearchApp\nVerified: The digital signature of the object did not verify.\nSigning date: 07:16 PM 02/21/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Noswk.PGN!MTB\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2025-02-23T01:38:33+00:00\nLast Submission: 2025-02-23T01:38:33+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "creation-time", "timestamp": "1784555977", "to_ids": false, "type": "datetime", "uuid": "d44291a4-0e80-4307-81ec-f06bd4dfb957", "value": "2025-02-12T04:04:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "ssdeep", "timestamp": "1784555977", "to_ids": true, "type": "ssdeep", "uuid": "79c5fb7f-63cb-4d64-9880-6331e8cc21c9", "value": "384:aPUOwL7nttgliUeL/XqRUdjq8srZqE9zLO1KxWrTWteMDBRJ2R9zw4vthKQxiz3p:ewXtcaSN5Z3zCIeM1PK9zvL432E6U" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555977", "to_ids": false, "type": "size-in-bytes", "uuid": "a8f999ed-10c4-4a71-9732-de86cd42f37b", "value": "32952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "vhash", "timestamp": "1784555977", "to_ids": true, "type": "vhash", "uuid": "79936cf1-d767-41f9-a946-3aeab44d2880", "value": "23403655151190811d60027" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-23T01:38:33+00:00", "last_seen": "2025-02-23T01:38:33+00:00", "object_relation": "filename", "timestamp": "1784555977", "to_ids": true, "type": "filename", "uuid": "1a0137b1-023e-43fd-9320-ef1475d79ce9", "value": "SearchApp" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557398", "uuid": "704310c6-ceff-4557-bda6-8caa0ea23ff7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "md5", "timestamp": "1784557397", "to_ids": true, "type": "md5", "uuid": "b8cb814d-5495-46f4-b615-b97e6fdfb843", "value": "08a7d798b60d6aa956665d2316b1d14d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "sha1", "timestamp": "1784557398", "to_ids": true, "type": "sha1", "uuid": "6233d00e-d7ae-42ef-8372-859ccf9c5e87", "value": "aa62336d64dbf11418b70590d35bf47e3a83c6c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "sha256", "timestamp": "1784557398", "to_ids": true, "type": "sha256", "uuid": "9286ec72-a7ca-4ba9-a8f1-a17e0d580359", "value": "45e98a89cc17770091a5e6cb44605c9488bf19f4f18a82be2b2b88f04583b0ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "text", "timestamp": "1784555998", "to_ids": false, "type": "text", "uuid": "17f542fb-fc71-44f1-addc-5668011c58c6", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 06:50 PM 02/23/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 13/74\nFirst Submission: 2025-02-24T06:32:16+00:00\nLast Submission: 2025-02-24T06:32:16+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "creation-time", "timestamp": "1784555998", "to_ids": false, "type": "datetime", "uuid": "728ed680-0544-4dc3-b912-8064be37c3d1", "value": "2024-12-25T17:22:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "ssdeep", "timestamp": "1784555998", "to_ids": true, "type": "ssdeep", "uuid": "6d9c114a-42bb-401c-b7b8-57e3b9dd18a2", "value": "3072:t3whOCAcdF0LzZpFGSLjZ1JrhIcCd1hyyVJJ1B5c:6hOncYRpFGSnVhIN1I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1784555998", "to_ids": false, "type": "size-in-bytes", "uuid": "0e207d55-7b45-4de9-b94d-9c14837239c3", "value": "202312" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "vhash", "timestamp": "1784555998", "to_ids": true, "type": "vhash", "uuid": "550e0847-8b54-46ab-9432-edca36f6b2fb", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-24T06:32:16+00:00", "last_seen": "2025-02-24T06:32:16+00:00", "object_relation": "filename", "timestamp": "1784555998", "to_ids": true, "type": "filename", "uuid": "23dbc185-f992-4dcf-98ec-d849e89306b4", "value": "45e98a89cc17770091a5e6cb44605c9488bf19f4f18a82be2b2b88f04583b0ae.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557399", "uuid": "95c8e804-d9e7-4b89-bdb1-1d9b68acbe95", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "md5", "timestamp": "1784557399", "to_ids": true, "type": "md5", "uuid": "017c6cdc-3cf9-469a-ac2f-249776f67058", "value": "4971fa254376791e1357d306a7d20c14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "sha1", "timestamp": "1784557399", "to_ids": true, "type": "sha1", "uuid": "db9927d9-44dc-48e0-99f1-c93c7100345d", "value": "d132f5a8adc0fafa9a7ef6243ec59f9641210f99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "sha256", "timestamp": "1784557399", "to_ids": true, "type": "sha256", "uuid": "9d3bd19d-3e1a-4353-be08-e36d5cbbd778", "value": "0f16d737b437c372e561fdaf022e7bf84a4f26ee5d56713e4f78ec9d888dc98a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "text", "timestamp": "1784556020", "to_ids": false, "type": "text", "uuid": "ff295d9b-05b9-453d-a354-00971e44f836", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 01:31 AM 02/25/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2025-02-25T02:44:08+00:00\nLast Submission: 2025-05-03T11:07:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "creation-time", "timestamp": "1784556020", "to_ids": false, "type": "datetime", "uuid": "fefbeb54-7e31-419f-9d11-512dda3e3e33", "value": "2024-12-25T17:22:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "ssdeep", "timestamp": "1784556020", "to_ids": true, "type": "ssdeep", "uuid": "2a209cac-5d42-4ba8-8b49-cb9ebe42c588", "value": "3072:93whOCAcdF0LzZpFGSLjZ1JrhIcCd1hyyVJJ1B/0yn:KhOncYRpFGSnVhIN1Vtn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556020", "to_ids": false, "type": "size-in-bytes", "uuid": "dd358a41-5f55-4d4c-b848-d63f4d493183", "value": "202312" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "vhash", "timestamp": "1784556020", "to_ids": true, "type": "vhash", "uuid": "0a9b0fbb-0fdd-4838-8667-ed2e1b1236e3", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T02:44:08+00:00", "last_seen": "2025-05-03T11:07:25+00:00", "object_relation": "filename", "timestamp": "1784556020", "to_ids": true, "type": "filename", "uuid": "4a69b837-d3d1-471a-aa91-7552cee83ed0", "value": "TASLoginBase.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557400", "uuid": "fcff4a41-6d22-42f2-a55c-dbdd2bd44062", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "md5", "timestamp": "1784557400", "to_ids": true, "type": "md5", "uuid": "6b92a234-bf1f-4817-b9bf-9f22f2293556", "value": "65b52425bb24866908624c412e26e17d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "sha1", "timestamp": "1784557400", "to_ids": true, "type": "sha1", "uuid": "8ea9fa6b-1428-4e03-a7d1-1a323d72d625", "value": "ba0fed5189ec8cf59938778c2288104acdff015c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "sha256", "timestamp": "1784557400", "to_ids": true, "type": "sha256", "uuid": "88bae82e-0309-4b39-ae40-c417e13dff9c", "value": "7144a0fdfda80239df8dd66bf6c9d9109d23112843f5cbd7fccf792ca4deabe5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "text", "timestamp": "1784556041", "to_ids": false, "type": "text", "uuid": "ac009330-80f6-4194-a11f-93ffc319f65d", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 10:06 AM 02/25/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 15/74\nFirst Submission: 2025-02-25T20:05:41+00:00\nLast Submission: 2025-02-27T08:01:07+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "creation-time", "timestamp": "1784556041", "to_ids": false, "type": "datetime", "uuid": "dfffe55e-28db-406f-b73d-d1834492dc35", "value": "2024-12-25T17:22:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "ssdeep", "timestamp": "1784556041", "to_ids": true, "type": "ssdeep", "uuid": "5b6079f8-2698-46f9-8be6-6a30e3edbfd1", "value": "3072:e3whOCAcdF0LzZpFGSLjZ1JrhIcCd1hyyVJJ1BRF:ThOncYRpFGSnVhIN19" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556041", "to_ids": false, "type": "size-in-bytes", "uuid": "696df87c-4b14-4c71-a91a-b86f3c2f8b3b", "value": "202312" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "vhash", "timestamp": "1784556041", "to_ids": true, "type": "vhash", "uuid": "6127ca24-73b7-42f5-8499-9818bcbe4f61", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T20:05:41+00:00", "last_seen": "2025-02-27T08:01:07+00:00", "object_relation": "filename", "timestamp": "1784556041", "to_ids": true, "type": "filename", "uuid": "7cf7289f-0cbc-44b3-8ab3-cdc4e5a9b0b7", "value": "7144a0fdfda80239df8dd66bf6c9d9109d23112843f5cbd7fccf792ca4deabe5.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557402", "uuid": "bb3a0572-ff1d-46e1-91f6-3330578391f5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "md5", "timestamp": "1784557402", "to_ids": true, "type": "md5", "uuid": "e3cba52b-55ec-44b7-804d-4285a2c54afb", "value": "56de83a7b477b9dcec9cc43f0cd4bc89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "sha1", "timestamp": "1784557402", "to_ids": true, "type": "sha1", "uuid": "3d6ff28b-41d5-4fd7-a93c-704dc6935e04", "value": "306ae68a1c87eafd49b6289ade84c972edb085d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "sha256", "timestamp": "1784557402", "to_ids": true, "type": "sha256", "uuid": "a1aadc2c-3559-423c-bac9-7ad58c4ae136", "value": "fe4d15893812679b1392f52304cc48e4f491484f1e08a4d62fadd20729f801aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "text", "timestamp": "1784556063", "to_ids": false, "type": "text", "uuid": "5b5e91c2-e846-4d43-9e72-be8fb9e03ea8", "value": "Type Description: Win32 EXE\nOriginal name: SearchApp\nVerified: The digital signature of the object did not verify.\nSigning date: 01:27 AM 02/25/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Jalapeno.AVN!MTB\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2025-02-25T02:27:28+00:00\nLast Submission: 2025-02-25T02:27:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "creation-time", "timestamp": "1784556063", "to_ids": false, "type": "datetime", "uuid": "57485fd8-1d2a-471d-bc1a-e4d5e936cdf4", "value": "2025-02-12T04:04:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "ssdeep", "timestamp": "1784556063", "to_ids": true, "type": "ssdeep", "uuid": "ce35d727-0d99-4d4a-b624-bad66f1924b9", "value": "384:FefvzfsVRJgVwLwJqRUdjq8srYEbLzLOixWrTWMeMDBRJ2R9zw4vtRKQxiOC8VS3:Fe7sVK0TN5nLzeBeM1PK9z3L4H2E" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556063", "to_ids": false, "type": "size-in-bytes", "uuid": "c743eb24-fcd3-4341-b4ba-b6aa28d74402", "value": "32440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "vhash", "timestamp": "1784556063", "to_ids": true, "type": "vhash", "uuid": "057a178a-fc71-4e5f-a5c6-fa8b75cee550", "value": "23403655151170811d40027" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-25T02:27:28+00:00", "last_seen": "2025-02-25T02:27:28+00:00", "object_relation": "filename", "timestamp": "1784556063", "to_ids": true, "type": "filename", "uuid": "14cfdbd3-1c0b-4903-a857-2a15c0bfedd5", "value": "SearchApp" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557403", "uuid": "ab331a75-a899-4ab6-bc2b-84b83b4e9f24", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "md5", "timestamp": "1784557403", "to_ids": true, "type": "md5", "uuid": "1d186443-2b63-46ea-9115-136115e60ae9", "value": "5d16bf1e869cb92f4be87b645b084d86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "sha1", "timestamp": "1784557403", "to_ids": true, "type": "sha1", "uuid": "e9711d99-38ac-402f-b64b-0603e7419ddd", "value": "cd50659bb2d343d8c936d1840a80f9e7c8f2c80e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "sha256", "timestamp": "1784557403", "to_ids": true, "type": "sha256", "uuid": "298dc46a-2597-4796-91e3-1bd5589ef47e", "value": "4e0a623842ca65209c2e5c5d2c42c874eb49b422cfd76a578ed0fcfa38285e44", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "text", "timestamp": "1784556084", "to_ids": false, "type": "text", "uuid": "5b4bf898-91e3-460b-a973-38af8a39a0fd", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 10:13 AM 02/25/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Jalapeno.AVN!MTB\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2025-02-26T06:53:32+00:00\nLast Submission: 2025-02-26T06:53:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "creation-time", "timestamp": "1784556085", "to_ids": false, "type": "datetime", "uuid": "7bd875ae-bc26-4229-a909-2fcde44fad8d", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "ssdeep", "timestamp": "1784556084", "to_ids": true, "type": "ssdeep", "uuid": "4b49a902-3fd7-4ce0-bae0-66566007dba0", "value": "384:g5vzfsVRJgVwLwJqRUdjq8srYEbyzLOTtW7wWh2OHRN7U/qNviCksR9z0CzKQxiH:g9sVK0TN5nyzA2G6Hio9zvL4y02Eqs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556084", "to_ids": false, "type": "size-in-bytes", "uuid": "1195d8be-0fbe-4d13-857b-931501e40f3b", "value": "33032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "vhash", "timestamp": "1784556084", "to_ids": true, "type": "vhash", "uuid": "6310084c-e16b-4371-bbfb-a0fe540832ce", "value": "23403655151170811d40027" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-26T06:53:32+00:00", "last_seen": "2025-02-26T06:53:32+00:00", "object_relation": "filename", "timestamp": "1784556084", "to_ids": true, "type": "filename", "uuid": "7e7a76f7-98b6-4c4b-9626-2029e5f18dac", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557404", "uuid": "b19e3b9f-624d-4d63-be0c-feb9686ca69e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "md5", "timestamp": "1784557404", "to_ids": true, "type": "md5", "uuid": "4af096c4-48b0-45f3-a96a-b1b56e750be5", "value": "c58b67400256d99b21eda65691e54e91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "sha1", "timestamp": "1784557404", "to_ids": true, "type": "sha1", "uuid": "8797815e-9395-454e-b428-15372f05e1b6", "value": "79998098700645a35083db8c16205434076ff3a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "sha256", "timestamp": "1784557404", "to_ids": true, "type": "sha256", "uuid": "ecf3a438-1591-4cad-8675-87fe600eeb5e", "value": "3e9e1b102eeaef7e4d6929f50ea8e1a115b4a0e51825ec63dadcc4f8f8308a80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "text", "timestamp": "1784556106", "to_ids": false, "type": "text", "uuid": "dacc7f6c-e051-4cd1-b9ab-1053bf1b3712", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 08:21 AM 02/28/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Jalapeno.AVN!MTB\nClamAV: None\nVT Total Detection: 37/74\nFirst Submission: 2025-02-28T16:03:59+00:00\nLast Submission: 2025-06-09T03:53:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "creation-time", "timestamp": "1784556106", "to_ids": false, "type": "datetime", "uuid": "8abbd8b8-47a8-42dd-88af-b0040cefc0f6", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "ssdeep", "timestamp": "1784556106", "to_ids": true, "type": "ssdeep", "uuid": "14630c46-1efc-4cda-b5dd-bad6142b8b09", "value": "12288:asdxBDDgTvNTpn/sTnaGnglUr7BGBPPrCc1gIkdu09:asveJT9/4Fg2r7cBw/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556106", "to_ids": false, "type": "size-in-bytes", "uuid": "1fa4a8aa-f0d0-4c86-a75c-4d4b4931983f", "value": "664824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "vhash", "timestamp": "1784556106", "to_ids": true, "type": "vhash", "uuid": "c32095e2-9efa-449e-aaac-83df51f651bb", "value": "2650367515131081366820159" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-28T16:03:59+00:00", "last_seen": "2025-06-09T03:53:56+00:00", "object_relation": "filename", "timestamp": "1784556106", "to_ids": true, "type": "filename", "uuid": "82e0c8e8-ea68-48d6-a8ae-daaf85585bd6", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557406", "uuid": "e2ee0abc-9789-468f-9ec9-6cd6d4de28d1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "md5", "timestamp": "1784557405", "to_ids": true, "type": "md5", "uuid": "285891ad-4ee4-4bd2-a518-ec19487c6870", "value": "4c6f439a52abc1a4898828944f62a85f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "sha1", "timestamp": "1784557405", "to_ids": true, "type": "sha1", "uuid": "38257578-d1d4-4f81-b757-261555047844", "value": "2cd4b75bb5692f49ec8c38436790516bf799d85f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "sha256", "timestamp": "1784557406", "to_ids": true, "type": "sha256", "uuid": "ac0a6ccb-7f18-4767-854a-2d6b3df2f52f", "value": "9e0079d05788440118d41a3d6d404e8385c947c1d3c3cc13645e24ee4eed67eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "text", "timestamp": "1784556128", "to_ids": false, "type": "text", "uuid": "ea6626b3-ef58-4690-8a29-7e19229e5605", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 03:31 PM 02/28/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2025-02-28T16:02:30+00:00\nLast Submission: 2025-03-21T11:14:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "creation-time", "timestamp": "1784556128", "to_ids": false, "type": "datetime", "uuid": "a047c225-e39c-44a2-8689-82cc4f727e4e", "value": "2025-02-27T14:28:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "ssdeep", "timestamp": "1784556128", "to_ids": true, "type": "ssdeep", "uuid": "230046a2-4bc0-4427-977b-15e0c89a9fd5", "value": "3072:SKRVq3wnk53qp9OT5qq9mchjR7ASiRMUUETVJR6mSGnM:FWwnkAp9OT5LhGSijM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556128", "to_ids": false, "type": "size-in-bytes", "uuid": "06f35092-48e3-472b-97a5-327c19f0bd84", "value": "242208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "vhash", "timestamp": "1784556128", "to_ids": true, "type": "vhash", "uuid": "77725a20-3326-49c5-a3ce-bdd3b9f953e7", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-28T16:02:30+00:00", "last_seen": "2025-03-21T11:14:55+00:00", "object_relation": "filename", "timestamp": "1784556128", "to_ids": true, "type": "filename", "uuid": "b4b4582e-0075-4f0a-8326-da63eb79ef03", "value": "9e0079d05788440118d41a3d6d404e8385c947c1d3c3cc13645e24ee4eed67eb.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557407", "uuid": "9b05d5e5-667d-4711-a05a-d07627a3e716", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "md5", "timestamp": "1784557407", "to_ids": true, "type": "md5", "uuid": "85e91d4f-31c6-49c0-a62e-219ecf380525", "value": "319a9d41e5ea023cdeb16dfcf32f4d51", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "sha1", "timestamp": "1784557407", "to_ids": true, "type": "sha1", "uuid": "8ba90aee-8b7d-4211-a957-68f1fdae1d31", "value": "015ceb41f1829f74e868d342751dc4baa3d6f8f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "sha256", "timestamp": "1784557407", "to_ids": true, "type": "sha256", "uuid": "efe0602f-4734-482b-9372-425bd007082a", "value": "950290ad8121990d1b481d827217964ab80e48954af82b19b08b132f06d0cac0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "text", "timestamp": "1784556150", "to_ids": false, "type": "text", "uuid": "d27b50b5-1378-421a-9395-59d34ecc7857", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 09:37 AM 02/21/2025\nSigners: \u8fd0\u57ce\u5e02\u76d0\u6e56\u533a\u98ce\u989c\u5546\u8d38\u6709\u9650\u516c\u53f8; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)\nMicrosoft: None\nClamAV: None\nVT Total Detection: 13/74\nFirst Submission: 2025-03-02T14:11:39+00:00\nLast Submission: 2025-10-14T00:55:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "creation-time", "timestamp": "1784556150", "to_ids": false, "type": "datetime", "uuid": "9fcd67b7-ee52-43ce-a40f-b85eccb4421c", "value": "2009-12-11T11:47:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "ssdeep", "timestamp": "1784556150", "to_ids": true, "type": "ssdeep", "uuid": "691d27b8-2441-4c84-b306-b386013b4941", "value": "3145728:7rN6faPEEDHYQewj3kCo4D4rx8+PKb4wMdLc2y6fYNQeu0a:3sSP7D4QdUHrxLCb4w2QTi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556150", "to_ids": false, "type": "size-in-bytes", "uuid": "b3155f2d-adea-4eca-b790-3f30ad192be1", "value": "124038656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "vhash", "timestamp": "1784556150", "to_ids": true, "type": "vhash", "uuid": "e8fc0b4e-dbaf-4340-8297-05bbfddac4f3", "value": "ab1d3fe086bf687ef4779bbe6bd97460" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-02T14:11:39+00:00", "last_seen": "2025-10-14T00:55:45+00:00", "object_relation": "filename", "timestamp": "1784556150", "to_ids": true, "type": "filename", "uuid": "21755d3e-a0f4-42e5-9fbe-bcc6a4f2972f", "value": "Aicoin (2).msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557408", "uuid": "18b0acd5-336d-48a7-9c18-9c7a6af30e43", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "md5", "timestamp": "1784557408", "to_ids": true, "type": "md5", "uuid": "ae41b21a-34d9-4094-bc80-638ffaa558f5", "value": "996ad0c04036d9e81596e44705b2f539", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "sha1", "timestamp": "1784557408", "to_ids": true, "type": "sha1", "uuid": "ae56d19b-dad0-4f82-8a42-eb096a4bc6c2", "value": "7c0b0f434865bf46e0a3c8fc3db1723d0f44a965", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "sha256", "timestamp": "1784557408", "to_ids": true, "type": "sha256", "uuid": "9ce4e71b-4a93-4fff-babc-6e56f22e89f6", "value": "94e0a257a33d62314d79016613a6d145c65460b9b6f689f27435b8f9cbbdb0cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "text", "timestamp": "1784556171", "to_ids": false, "type": "text", "uuid": "37274a64-7d63-4f30-834b-b872fccdec47", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 05:29 AM 03/03/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2025-03-03T12:36:06+00:00\nLast Submission: 2025-06-07T18:52:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "creation-time", "timestamp": "1784556172", "to_ids": false, "type": "datetime", "uuid": "79c69922-d33f-4014-b42b-c9c08d22a435", "value": "2025-02-27T14:29:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "ssdeep", "timestamp": "1784556171", "to_ids": true, "type": "ssdeep", "uuid": "6f74d558-fd26-44e3-b75f-5e4329b568cd", "value": "6144:kS4aZ8QdPbf5phIS+/oD/FWAg+UobgM8tdPvigi8:kujPbf5tbIggMUcgT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556171", "to_ids": false, "type": "size-in-bytes", "uuid": "fd8d8af7-9c0b-402c-a1e9-247752d7abd7", "value": "415912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "vhash", "timestamp": "1784556171", "to_ids": true, "type": "vhash", "uuid": "ae64c9e7-b05f-4217-822b-aa152b794a89", "value": "145086651d1510165d156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-03T12:36:06+00:00", "last_seen": "2025-06-07T18:52:45+00:00", "object_relation": "filename", "timestamp": "1784556171", "to_ids": true, "type": "filename", "uuid": "bc348a2c-77e7-4c80-9958-e082384ccbeb", "value": "TASLoginBase.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557409", "uuid": "f05a0525-6d39-4548-b0aa-1d04d3b82d15", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "md5", "timestamp": "1784557409", "to_ids": true, "type": "md5", "uuid": "66e195c1-d5a8-4c48-94ea-d8067792346f", "value": "870250493aa7c48e54f2b48c9c6e4794", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "sha1", "timestamp": "1784557409", "to_ids": true, "type": "sha1", "uuid": "6304631c-f147-4f56-bf8a-215c0d952f03", "value": "15be27b704770806ae516ec23be1a5a176e789bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "sha256", "timestamp": "1784557409", "to_ids": true, "type": "sha256", "uuid": "ea203470-96b5-4a0c-83a6-3a455a13a9c2", "value": "cfd15665b1224fc3d8e3f957bf17aedf86461efbc7ae9810ff81ac64c8295dc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "text", "timestamp": "1784556193", "to_ids": false, "type": "text", "uuid": "a422581f-b909-4e73-9010-5349f27d23e3", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 05:37 AM 03/03/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 36/74\nFirst Submission: 2025-03-03T12:18:28+00:00\nLast Submission: 2025-03-20T10:22:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "creation-time", "timestamp": "1784556193", "to_ids": false, "type": "datetime", "uuid": "b6fbe1b7-d3d5-4559-a1f3-715b81ac27c0", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "ssdeep", "timestamp": "1784556193", "to_ids": true, "type": "ssdeep", "uuid": "247e5b22-09b0-4cbc-857b-ed557e853fa6", "value": "768:eBNs4XjMNWSrlNi0RI2i6Rio9z86ge2Er8:IscMNprzii9i6Igz8xex8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556193", "to_ids": false, "type": "size-in-bytes", "uuid": "e1237c3f-cdb6-4ff7-985b-3f624590717d", "value": "40696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "vhash", "timestamp": "1784556193", "to_ids": true, "type": "vhash", "uuid": "f3900118-89b8-4ffa-a2ee-fa166beae25e", "value": "24403655151170891140021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-03T12:18:28+00:00", "last_seen": "2025-03-20T10:22:36+00:00", "object_relation": "filename", "timestamp": "1784556193", "to_ids": true, "type": "filename", "uuid": "2f476e9b-a8ba-4dbf-9c01-bc4a9885c51a", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557410", "uuid": "0d7c352b-65be-45c6-906c-9ebd025f824e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "md5", "timestamp": "1784557410", "to_ids": true, "type": "md5", "uuid": "7d3893e0-b680-46b3-ad11-325d70851159", "value": "18c533b784e2a7ebfb4def8c282efdcd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "sha1", "timestamp": "1784557410", "to_ids": true, "type": "sha1", "uuid": "d58a462a-b111-44fe-9b4e-f682827f8df9", "value": "567a55f7b94479b60473668dfc54c9601bb1ba53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "sha256", "timestamp": "1784557410", "to_ids": true, "type": "sha256", "uuid": "664faa6f-863d-47f7-88c4-0fbfd10e65fc", "value": "7eeea3c88f103509ce0b98147a6cf686d03e3c1ad8ec524a4c4b6776e99f165b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "text", "timestamp": "1784556215", "to_ids": false, "type": "text", "uuid": "0b5b0058-94d2-40cf-a056-631cacd7f533", "value": "Type Description: Win32 EXE\nOriginal name: SearchApp\nVerified: The digital signature of the object did not verify.\nSigning date: 04:26 PM 03/03/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2025-03-05T18:19:53+00:00\nLast Submission: 2025-03-14T12:46:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "creation-time", "timestamp": "1784556215", "to_ids": false, "type": "datetime", "uuid": "d399f728-09fc-44be-96f6-4e7184561335", "value": "2025-02-12T04:04:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "ssdeep", "timestamp": "1784556215", "to_ids": true, "type": "ssdeep", "uuid": "a95ca16c-f61c-4b4e-af4e-dd9a3a3bdbb9", "value": "768:QSppFaDoNh89+7zA0toeM1PI9zf6do2Ek:fkoNysPAyoesPAzfwoa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556215", "to_ids": false, "type": "size-in-bytes", "uuid": "9dd1533c-1e15-419d-a39e-906ce90a6eb9", "value": "41632" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "vhash", "timestamp": "1784556215", "to_ids": true, "type": "vhash", "uuid": "b32fe596-4dd5-4ad2-b56c-85466a042d34", "value": "24403655151170891160021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-05T18:19:53+00:00", "last_seen": "2025-03-14T12:46:50+00:00", "object_relation": "filename", "timestamp": "1784556215", "to_ids": true, "type": "filename", "uuid": "ed4f8783-75e4-4ab6-a3b6-11f5b77fbeca", "value": "SearchApp" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557411", "uuid": "d2d0a58e-8fba-4e3a-b909-1200468892bd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "md5", "timestamp": "1784557411", "to_ids": true, "type": "md5", "uuid": "67c9d3d5-2315-432b-9782-81d8157b3d14", "value": "69c94e5bcf80bf53ffa778786b8f20fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "sha1", "timestamp": "1784557411", "to_ids": true, "type": "sha1", "uuid": "83dbb88b-ccd7-49cc-af1d-92cce39bcd38", "value": "97af8cbc3b73fa1cd39e7c650f1513360523bf50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "sha256", "timestamp": "1784557411", "to_ids": true, "type": "sha256", "uuid": "c65eef7c-5320-4753-aff9-1bdc40b3ce2c", "value": "9781d1362da83eb3d029bd9155fd4f88852bdc4c7c9fb204521e42c2602962ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "text", "timestamp": "1784556237", "to_ids": false, "type": "text", "uuid": "f74b3c98-0787-45c1-b124-3c50585e8a59", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 03:07 PM 03/03/2025\nSigners: PrimeSnap Technologies Network Company; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2025-03-05T18:51:49+00:00\nLast Submission: 2025-09-16T03:39:53+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "creation-time", "timestamp": "1784556237", "to_ids": false, "type": "datetime", "uuid": "6600deec-527b-4e2e-8530-ed89cc873f9e", "value": "2018-12-15T22:26:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "ssdeep", "timestamp": "1784556237", "to_ids": true, "type": "ssdeep", "uuid": "da23e88f-6258-425b-99a1-5cb9fd03b863", "value": "1572864:++u/x6vSa4mq+ryE103SZurRov2WS0SJw22l5NhHQjiH+:++x6r+rLFsrWW1el5jQjie" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556237", "to_ids": false, "type": "size-in-bytes", "uuid": "5751bd9a-c781-4a4b-8779-404a35d25b94", "value": "79354672" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "vhash", "timestamp": "1784556237", "to_ids": true, "type": "vhash", "uuid": "dddfb68b-5e14-44a8-b069-fc27aa884338", "value": "077056655d1c0550d043z800417z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-05T18:51:49+00:00", "last_seen": "2025-09-16T03:39:53+00:00", "object_relation": "filename", "timestamp": "1784556237", "to_ids": true, "type": "filename", "uuid": "c49313a2-4177-4711-9f15-8a128f041101", "value": "AdobeSign Setup 8.21.2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557413", "uuid": "a78c285b-66f7-41ab-b29c-34b71f72c277", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "md5", "timestamp": "1784557412", "to_ids": true, "type": "md5", "uuid": "4d5e84b5-ea4e-4019-9c29-9c3ec72893d1", "value": "2d9cc1ef95162c8deb3359dbb877cd61", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "sha1", "timestamp": "1784557413", "to_ids": true, "type": "sha1", "uuid": "52476fc4-74a2-471b-a42b-0e9a4551e63c", "value": "5a977c3975057b302790ecc8557f0027c96d4d7d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "sha256", "timestamp": "1784557413", "to_ids": true, "type": "sha256", "uuid": "b749c54d-f2a8-4be1-b01e-7fc4aa3731a9", "value": "20354da713c8e4eef18b353d06834e6e7bf3edc68c015ab74ec4b1f443d2575a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "text", "timestamp": "1784556259", "to_ids": false, "type": "text", "uuid": "3cb4937e-1b61-4a15-b5b6-ca867cd0c524", "value": "Type Description: Win32 EXE\nOriginal name: SearchApp\nVerified: The digital signature of the object did not verify.\nSigning date: 02:25 AM 03/06/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 37/74\nFirst Submission: 2025-03-06T10:01:46+00:00\nLast Submission: 2025-08-07T05:43:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "creation-time", "timestamp": "1784556259", "to_ids": false, "type": "datetime", "uuid": "cb1bb89e-9e76-45df-bd70-1ce8a47cd9ea", "value": "2025-02-12T04:04:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "ssdeep", "timestamp": "1784556259", "to_ids": true, "type": "ssdeep", "uuid": "96d9982c-621d-453e-9b09-ea6bd0ab40a3", "value": "768:cSZpoYnoNhiRZl20f3eM1PA9zj206ide2Ezt:btoNAfl243esPIzjFPUz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556259", "to_ids": false, "type": "size-in-bytes", "uuid": "558c2924-48c3-428f-92fc-98498d052f19", "value": "43408" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "vhash", "timestamp": "1784556259", "to_ids": true, "type": "vhash", "uuid": "04c17066-fcd1-4fcf-91b1-1e2573fb134c", "value": "24403655151170891160021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-06T10:01:46+00:00", "last_seen": "2025-08-07T05:43:23+00:00", "object_relation": "filename", "timestamp": "1784556259", "to_ids": true, "type": "filename", "uuid": "ad7b797b-480c-44f7-bf84-aa385be58c0d", "value": "SearchApp" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557414", "uuid": "321bb5bf-a83b-4311-a4f2-39ae8e0c07be", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "md5", "timestamp": "1784557414", "to_ids": true, "type": "md5", "uuid": "de3d838a-e1e0-4552-929d-cc854bb96480", "value": "c114a1eaa4e195d32af6121f8f3fa550", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "sha1", "timestamp": "1784557414", "to_ids": true, "type": "sha1", "uuid": "676557a3-2b45-4e17-b197-9041d1307d07", "value": "1a114b0b250360be79a5ffa2c7040101d1187fc2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "sha256", "timestamp": "1784557414", "to_ids": true, "type": "sha256", "uuid": "ab9e002f-1dd4-4584-867c-28ea2bdb8513", "value": "6155fa05d684ca5f13c0fb27d25f33db62209ed4756cf74ead66a481410d021c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "text", "timestamp": "1784556281", "to_ids": false, "type": "text", "uuid": "41a460e6-6fa9-4f81-8277-3203072ec80a", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 01:10 PM 03/01/2025\nSigners: Shanghai Linyao Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign Root CA - R3\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2025-03-08T17:44:59+00:00\nLast Submission: 2025-03-08T17:44:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "creation-time", "timestamp": "1784556281", "to_ids": false, "type": "datetime", "uuid": "989345f5-3b45-41c9-b374-c8ccc8de82a9", "value": "2025-03-01T12:26:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "ssdeep", "timestamp": "1784556281", "to_ids": true, "type": "ssdeep", "uuid": "73b65381-d74c-4252-ba63-c5f65d9fd640", "value": "768:4uTCgyzjvg4J1f9F6rn12Jsso5oKT/7eM+R3r2jd2ER:mRHvrJ1FFMnQusoFTjeXRbsdz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556281", "to_ids": false, "type": "size-in-bytes", "uuid": "0535b63d-bacb-40c2-8a9c-0e85c6b166e2", "value": "60208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "vhash", "timestamp": "1784556281", "to_ids": true, "type": "vhash", "uuid": "ea7c3782-a5aa-4b2b-992d-e094f9999231", "value": "164046655d156az18nz16z163z5c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-08T17:44:59+00:00", "last_seen": "2025-03-08T17:44:59+00:00", "object_relation": "filename", "timestamp": "1784556281", "to_ids": true, "type": "filename", "uuid": "3bd552ce-d441-4327-8389-93def568995e", "value": "Updater.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557415", "uuid": "1c3902ae-6e24-4d31-b71d-0cbf3708d416", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "md5", "timestamp": "1784557415", "to_ids": true, "type": "md5", "uuid": "6ecb1fb1-482e-41ea-b819-f2603f44ed68", "value": "46f169bdf8a6e0641ba59f37b4d19caf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "sha1", "timestamp": "1784557415", "to_ids": true, "type": "sha1", "uuid": "9bccf5d6-0822-496d-9e09-2a86f93a2d30", "value": "5df5fe1ee30da96b1b36645dbfca6cca8cee76fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "sha256", "timestamp": "1784557415", "to_ids": true, "type": "sha256", "uuid": "a4dd68a1-dbe5-4a5b-9e36-9cda19178486", "value": "1b0cb8df1e30d264491ddb8904d1395767755d92fc2b7e9f792ddb75ed1aa4c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "text", "timestamp": "1784556302", "to_ids": false, "type": "text", "uuid": "387e2a8f-143a-4345-853f-9af5a9c3ebb7", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 11:53 AM 03/09/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 38/74\nFirst Submission: 2025-03-09T19:55:36+00:00\nLast Submission: 2025-04-09T11:02:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "creation-time", "timestamp": "1784556303", "to_ids": false, "type": "datetime", "uuid": "a476b391-ef99-4f3a-bd7e-1dfc7af0e7aa", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "ssdeep", "timestamp": "1784556302", "to_ids": true, "type": "ssdeep", "uuid": "838a2200-2379-4d80-a2b5-ce387950342f", "value": "12288:j6CdWzXGl81R18w0OsM3gGdNTQaHegr6evb4uUTz:uCIzL1R18waKdNTQIj/Sz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556302", "to_ids": false, "type": "size-in-bytes", "uuid": "40a94449-bb2b-4228-b523-e9b1b37ece8e", "value": "667896" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "vhash", "timestamp": "1784556302", "to_ids": true, "type": "vhash", "uuid": "36b4c1bc-b5ed-475b-9768-b7f0e48070b2", "value": "2650367515132081767810149" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T19:55:36+00:00", "last_seen": "2025-04-09T11:02:28+00:00", "object_relation": "filename", "timestamp": "1784556302", "to_ids": true, "type": "filename", "uuid": "64d6d358-dd06-4cff-bc86-aea5daa72274", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557416", "uuid": "a19e5508-adaf-48dc-86c0-38734a837e81", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "md5", "timestamp": "1784557416", "to_ids": true, "type": "md5", "uuid": "82bb7d77-a05c-4ed3-a1a6-5ce678d58e46", "value": "e9ad3553e2c0b2de67c37ebf3daba726", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "sha1", "timestamp": "1784557416", "to_ids": true, "type": "sha1", "uuid": "847e2550-00d2-4c2f-867e-400f5b972dd7", "value": "10ab67df76b55337e62cc62a705f937491afdeda", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "sha256", "timestamp": "1784557416", "to_ids": true, "type": "sha256", "uuid": "622dfbf5-545d-4fbc-ad56-6be051c3f4d6", "value": "55f7f34e141b49f96cb2f9d1df6581b46c0414c1f83f1f13d38935af30efcab7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "text", "timestamp": "1784556324", "to_ids": false, "type": "text", "uuid": "bac5cc95-54b0-4b57-ab51-e5efdcae822b", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 02:09 PM 03/08/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2025-03-09T00:54:20+00:00\nLast Submission: 2025-03-21T11:14:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "creation-time", "timestamp": "1784556324", "to_ids": false, "type": "datetime", "uuid": "362ae10b-0589-433b-82cd-52ab290888f8", "value": "2025-02-27T14:29:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "ssdeep", "timestamp": "1784556324", "to_ids": true, "type": "ssdeep", "uuid": "db73d76b-b2d3-41eb-a6af-fd0616fe62b9", "value": "3072:UXcgSIooR4sx63if+Ixwya90QWsIzZPq++GNDo2wCCBsqh/rZjVgJpy5/bWv:efw4wya9/WZPqsmCCd/pCv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556324", "to_ids": false, "type": "size-in-bytes", "uuid": "82924cd3-1cd2-45ac-a891-02e9b2cbd0a9", "value": "237600" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "vhash", "timestamp": "1784556324", "to_ids": true, "type": "vhash", "uuid": "59ff3298-af23-4f59-a34c-fe7070ced016", "value": "125066655d1510156az4!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T00:54:20+00:00", "last_seen": "2025-03-21T11:14:42+00:00", "object_relation": "filename", "timestamp": "1784556324", "to_ids": true, "type": "filename", "uuid": "2dafe4d7-c959-43c4-ae8b-a2e9bb5512b0", "value": "55f7f34e141b49f96cb2f9d1df6581b46c0414c1f83f1f13d38935af30efcab7.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557417", "uuid": "7d3d9669-7b6b-4e5e-9412-f73a116bb5f3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "md5", "timestamp": "1784557417", "to_ids": true, "type": "md5", "uuid": "5523e35e-1c28-4e4c-8734-149b1c677bba", "value": "5786397d6b652d8d4e5b7f2312e9358f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "sha1", "timestamp": "1784557417", "to_ids": true, "type": "sha1", "uuid": "3a2078fc-74cb-46a5-9d70-f34792ccfa0e", "value": "d05c4f51696d20564f311d59f2c7188bd15c1307", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "sha256", "timestamp": "1784557417", "to_ids": true, "type": "sha256", "uuid": "7128c75d-1844-4969-914b-3e5913f75a55", "value": "be54b1ee9aeab4d914403807565bf335814c73ea58e26410c81d2a17e8799c13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "text", "timestamp": "1784556346", "to_ids": false, "type": "text", "uuid": "1a6c5149-7bc6-42f0-ac44-2b4c09fcf05d", "value": "Type Description: Win32 EXE\nOriginal name: SearchApp\nVerified: The digital signature of the object did not verify.\nSigning date: 03:23 PM 03/08/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 35/74\nFirst Submission: 2025-03-09T00:50:37+00:00\nLast Submission: 2025-03-09T00:50:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "creation-time", "timestamp": "1784556346", "to_ids": false, "type": "datetime", "uuid": "1d396369-30c2-4f21-9905-22399953b28a", "value": "2025-02-12T04:04:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "ssdeep", "timestamp": "1784556346", "to_ids": true, "type": "ssdeep", "uuid": "3634e80d-0aa4-4e63-8ca0-a8e623336195", "value": "12288:+BL5uEyuUMQo8MiYPklh8g7JmI0E0T1hxw6hPJNN4yLuE:+t5uEyZMiYQmlwG14yLuE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556346", "to_ids": false, "type": "size-in-bytes", "uuid": "f85bff7d-cc59-4c49-be03-6aa9994ced32", "value": "673440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "vhash", "timestamp": "1784556346", "to_ids": true, "type": "vhash", "uuid": "1288f6a5-c6ee-4722-9309-b1aab4d37980", "value": "265036751513308176aa2015a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-09T00:50:37+00:00", "last_seen": "2025-03-09T00:50:37+00:00", "object_relation": "filename", "timestamp": "1784556346", "to_ids": true, "type": "filename", "uuid": "b8f82dae-7f23-4f43-80bf-809708afacb9", "value": "SearchApp" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557418", "uuid": "a961e0b9-9858-4f02-bf02-72c65637d1a1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "md5", "timestamp": "1784557418", "to_ids": true, "type": "md5", "uuid": "76b47b1a-59e4-41ff-ae03-b76f00aedbb5", "value": "9905bf91d0e085747b6f595a7eca6dcd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "sha1", "timestamp": "1784557418", "to_ids": true, "type": "sha1", "uuid": "4366ff95-aa06-4749-a26e-ba52ac4904d7", "value": "10955abe37a2ca6a42aa8c0cefbcadf3cafd0aa9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "sha256", "timestamp": "1784557418", "to_ids": true, "type": "sha256", "uuid": "23dcf1ff-40a4-4002-a644-4faa5c90b947", "value": "9149934feacd6b6fbfcbf308005f48f1bd25470df5de900cf1821361c394bf1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "text", "timestamp": "1784556367", "to_ids": false, "type": "text", "uuid": "0ce26066-c1be-4ba8-830b-91e7abe42628", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 02:41 AM 03/10/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 40/74\nFirst Submission: 2025-03-10T05:58:51+00:00\nLast Submission: 2025-03-20T10:22:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "creation-time", "timestamp": "1784556367", "to_ids": false, "type": "datetime", "uuid": "5abf203d-0031-4732-bd37-bd46377be1ec", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "ssdeep", "timestamp": "1784556367", "to_ids": true, "type": "ssdeep", "uuid": "87eeadc9-6335-42dd-91df-d2fadac8e9ba", "value": "768:OSJWpNoNh61tDcG5KNis0w2c6Rio9zr6FfP2E:+zoNA1SG5misGc6IgzrU3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556367", "to_ids": false, "type": "size-in-bytes", "uuid": "58dcbd67-7eeb-4223-abe1-c472705ba1e4", "value": "42232" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "vhash", "timestamp": "1784556367", "to_ids": true, "type": "vhash", "uuid": "a15b94ff-8ebd-46c0-b7a7-62c75ea8e4e8", "value": "24403655151170891160021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-10T05:58:51+00:00", "last_seen": "2025-03-20T10:22:51+00:00", "object_relation": "filename", "timestamp": "1784556367", "to_ids": true, "type": "filename", "uuid": "380595ba-6a70-42ac-9f1c-3abdc4c89109", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557419", "uuid": "811f2e20-7533-4149-b402-f1042b790c84", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "md5", "timestamp": "1784557419", "to_ids": true, "type": "md5", "uuid": "37fe18b7-0567-4dbe-9d73-bbd2b8a26330", "value": "d32ec5c4a8279c76a41f0f36c06207e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "sha1", "timestamp": "1784557419", "to_ids": true, "type": "sha1", "uuid": "8dafc1b1-eb47-417f-94c1-a6cb9c32e377", "value": "0c468fc52c4fe3fed7849680ae6d5f4c4045d8f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "sha256", "timestamp": "1784557419", "to_ids": true, "type": "sha256", "uuid": "cc668b80-f138-4a51-9f1c-54315ef4c0d2", "value": "872842a8bd4eddf8d10d172e15211954d7b3b1d4fe1112a7a1fa236c24e35db5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "text", "timestamp": "1784556389", "to_ids": false, "type": "text", "uuid": "b9196a22-56f3-4ee6-97dc-45b7d2fb367e", "value": "Type Description: Win32 EXE\nOriginal name: setup-us.exe\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 02:48 PM 03/09/2025\nSigners: \u8fd0\u57ce\u5e02\u76d0\u6e56\u533a\u98ce\u989c\u5546\u8d38\u6709\u9650\u516c\u53f8; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)\nMicrosoft: None\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2025-03-10T16:57:28+00:00\nLast Submission: 2025-03-10T16:57:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "creation-time", "timestamp": "1784556389", "to_ids": false, "type": "datetime", "uuid": "a57bba1b-24b9-4595-9c9b-abc1f5582f65", "value": "2020-03-17T15:16:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "ssdeep", "timestamp": "1784556389", "to_ids": true, "type": "ssdeep", "uuid": "ed20fbd8-1896-479d-8455-cb5e715cd4f7", "value": "3145728:rhq0s6w519ahArW9rpW5JCWLU3OA2AaPMdPNvFMYo40ZvmJoY6e43SKbl0T:rM0s6O1WArWnWKaKOXAau/o4EIAWT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556389", "to_ids": false, "type": "size-in-bytes", "uuid": "cd3ab2e7-1114-45e9-b53f-ded13b6b0a91", "value": "182755400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "vhash", "timestamp": "1784556389", "to_ids": true, "type": "vhash", "uuid": "c18f2437-b38c-477b-a465-e48356a85cc8", "value": "018056655d15156aza6!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-10T16:57:28+00:00", "last_seen": "2025-03-10T16:57:28+00:00", "object_relation": "filename", "timestamp": "1784556389", "to_ids": true, "type": "filename", "uuid": "23d75286-be4e-4ccc-8a85-4f339f5ee535", "value": "setup-us.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557421", "uuid": "afe134a7-7ad6-4b5b-974f-11c451ad5469", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "md5", "timestamp": "1784557421", "to_ids": true, "type": "md5", "uuid": "780dc610-a730-4560-a1d5-1f7e0cc96555", "value": "6de5956921fe05b3281cc7c27062edba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "sha1", "timestamp": "1784557421", "to_ids": true, "type": "sha1", "uuid": "ac5e6188-a3e0-4678-b188-506dea9de335", "value": "84197351a02701235e21effc823045951072a6bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "sha256", "timestamp": "1784557421", "to_ids": true, "type": "sha256", "uuid": "ef2f2602-1219-48ab-be11-ebf316b6115e", "value": "7b8e66b3d973a17e3e9442107d98aa5d6797a929513a12b6bffd051aa36c2e4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "text", "timestamp": "1784556411", "to_ids": false, "type": "text", "uuid": "c7b90a24-f408-4da3-9c9c-299f54f016d9", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 07:46 AM 03/11/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 38/74\nFirst Submission: 2025-03-11T13:12:20+00:00\nLast Submission: 2025-03-21T11:27:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "creation-time", "timestamp": "1784556411", "to_ids": false, "type": "datetime", "uuid": "e3517e3f-0e44-4646-a6a4-f1f0c8b623c2", "value": "2025-02-27T14:29:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "ssdeep", "timestamp": "1784556411", "to_ids": true, "type": "ssdeep", "uuid": "9985d447-d519-49d0-8955-b7f70e2c94df", "value": "6144:YS4aZ8QdPbM5phIS+FQwtcRS6AM+0h8wC97DIEER1MpBiqlopEHKduCtHLQj3LmE:YujPbM5t+Fr6Ax0HEpWY2uyQIwH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556411", "to_ids": false, "type": "size-in-bytes", "uuid": "13bc5cba-6268-4518-8680-20602883c010", "value": "688168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "vhash", "timestamp": "1784556411", "to_ids": true, "type": "vhash", "uuid": "c3cf03fc-1f7f-4711-8b33-68a0ab2a2b3d", "value": "165086651d1510165d556bz1tz18z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T13:12:20+00:00", "last_seen": "2025-03-21T11:27:00+00:00", "object_relation": "filename", "timestamp": "1784556411", "to_ids": true, "type": "filename", "uuid": "f949c803-e7b9-4c0f-81d9-65e0fe94cb04", "value": "7b8e66b3d973a17e3e9442107d98aa5d6797a929513a12b6bffd051aa36c2e4c.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557422", "uuid": "3e244112-fa21-4774-a2d1-f7bac1c24c40", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "md5", "timestamp": "1784557421", "to_ids": true, "type": "md5", "uuid": "c415b811-64c2-44de-b52e-30d7000c7d70", "value": "9b5b5d82e1fd90d435ec643052e2e4a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "sha1", "timestamp": "1784557421", "to_ids": true, "type": "sha1", "uuid": "1fb8b471-d8e1-46e7-8cd6-7418cc429a66", "value": "ce2d1ccdc333787b212f94f982124b062f19c633", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "sha256", "timestamp": "1784557422", "to_ids": true, "type": "sha256", "uuid": "dde0a6a3-ed4c-4e7b-ad43-2fa588ccb541", "value": "2e87acd5d7524935e2e79f9060140a15447ac6a1ed761e77b11bb81db368a1c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "text", "timestamp": "1784556432", "to_ids": false, "type": "text", "uuid": "206481cb-d610-4504-8115-f551f4755568", "value": "Type Description: Win32 DLL\nOriginal name: xlbrowsershell.rc\nVerified: Signed\nSigning date: 03:04 PM 03/11/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2025-03-11T19:56:59+00:00\nLast Submission: 2025-03-21T11:24:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "creation-time", "timestamp": "1784556432", "to_ids": false, "type": "datetime", "uuid": "50a20cb9-4c8a-4078-9991-3ae54481c961", "value": "2025-03-11T13:17:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "ssdeep", "timestamp": "1784556432", "to_ids": true, "type": "ssdeep", "uuid": "ed385d99-997a-47d3-aa16-ff2224c6724b", "value": "6144:8Pqri8fN01GZGIc05W4YpfXl3umDfJu3ronB04jizo:zi8fNlcrdlfJ8rdo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556432", "to_ids": false, "type": "size-in-bytes", "uuid": "bac2087d-83c9-43bc-86ef-ee2548cee308", "value": "479264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "vhash", "timestamp": "1784556432", "to_ids": true, "type": "vhash", "uuid": "fa97d43f-831b-46b5-bb78-78bf7e8c2d5d", "value": "145096655d551d15165d5bz1=z43" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T19:56:59+00:00", "last_seen": "2025-03-21T11:24:28+00:00", "object_relation": "filename", "timestamp": "1784556432", "to_ids": true, "type": "filename", "uuid": "f73d0679-68de-4953-9226-7170ff8b8f37", "value": "xlbrowsershell.rc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557423", "uuid": "9644105e-7bf8-4b08-b399-567903d9f567", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "md5", "timestamp": "1784557423", "to_ids": true, "type": "md5", "uuid": "8e044b7b-5ae0-46d2-90fb-5dabc8118bb8", "value": "acbee5535217abbe8aea119ffd285b63", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "sha1", "timestamp": "1784557423", "to_ids": true, "type": "sha1", "uuid": "8b03f71f-dd19-4e20-ac1d-e2f226d74d6c", "value": "5067437a394551685676b91c7c8fb0a8f84a0dfa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "sha256", "timestamp": "1784557423", "to_ids": true, "type": "sha256", "uuid": "972ba7f4-d1ca-45cf-a19c-1d4543a85779", "value": "b5f76b6641cc57840712d4031721a861eb9afff284b4b9486db5f996dd7a9e59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "text", "timestamp": "1784556454", "to_ids": false, "type": "text", "uuid": "68489e5f-3140-4e85-ba40-6c0fbd762e52", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 04:04 PM 03/11/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 41/74\nFirst Submission: 2025-03-11T19:53:35+00:00\nLast Submission: 2025-03-12T02:10:14+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "creation-time", "timestamp": "1784556454", "to_ids": false, "type": "datetime", "uuid": "490a635b-38b6-41a3-a192-bbb9cebb74c9", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "ssdeep", "timestamp": "1784556454", "to_ids": true, "type": "ssdeep", "uuid": "50cc144d-8425-4730-a6cd-bdc80aa86a5d", "value": "3072:hbS0HTVCQ7RuUj20en7o8w/qXj+4a5R1ypDIif4NBUFpWPlVhr5huORDjrHOzQB4:VHZuUjzL5OxDrZOlvhdizaCHrE35LZO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556454", "to_ids": false, "type": "size-in-bytes", "uuid": "82a56cd2-4dc9-42bc-b118-dacbd976cf97", "value": "299256" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "vhash", "timestamp": "1784556454", "to_ids": true, "type": "vhash", "uuid": "44c6ea73-fb37-4b91-bc14-4a5a91d177e4", "value": "225036651512f081766800139" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T19:53:35+00:00", "last_seen": "2025-03-12T02:10:14+00:00", "object_relation": "filename", "timestamp": "1784556454", "to_ids": true, "type": "filename", "uuid": "67247396-759e-48d2-88c1-83f1501c3649", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557424", "uuid": "fcac99c9-f661-4427-a144-4a195ce71d38", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "md5", "timestamp": "1784557424", "to_ids": true, "type": "md5", "uuid": "51d017b3-12a6-42af-adca-2186943a6f7f", "value": "652d66665aa3c628cf4c8558ba8bb88f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "sha1", "timestamp": "1784557424", "to_ids": true, "type": "sha1", "uuid": "1ed8c9cf-7874-419e-ab6d-c217a973678c", "value": "fd637e3e39d6daf8cfc8551b6d63d72e6e24123d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "sha256", "timestamp": "1784557424", "to_ids": true, "type": "sha256", "uuid": "01d00b5a-13f8-4cfa-a3cd-3a4156112a03", "value": "9a8cfb7525dbf845d55a8aa1410306c15a616e9ce8727347ef29456ead09478f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "text", "timestamp": "1784556475", "to_ids": false, "type": "text", "uuid": "dcc74578-870f-4a23-9d21-92ef4fbe69bf", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 06:52 AM 03/11/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 36/74\nFirst Submission: 2025-03-11T12:54:39+00:00\nLast Submission: 2025-03-11T12:55:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "creation-time", "timestamp": "1784556476", "to_ids": false, "type": "datetime", "uuid": "89156cee-1f8a-46b1-a708-a1bc789f578d", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "ssdeep", "timestamp": "1784556475", "to_ids": true, "type": "ssdeep", "uuid": "0098cf60-0b87-4e64-9899-ae76ddbca4d2", "value": "6144:dnje7Bu1RqDhahoRiX+lOceO8sgRhAU77DBzl:dh6wCI9OUKU77D7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556475", "to_ids": false, "type": "size-in-bytes", "uuid": "0e0c2f5f-7e6a-435c-9434-4b4190dbf38f", "value": "313592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "vhash", "timestamp": "1784556475", "to_ids": true, "type": "vhash", "uuid": "1120e642-fd55-4b1f-bf9d-a6a34a9f21e8", "value": "2350366515132081767810149" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-11T12:54:39+00:00", "last_seen": "2025-03-11T12:55:30+00:00", "object_relation": "filename", "timestamp": "1784556475", "to_ids": true, "type": "filename", "uuid": "b61fd2d7-dada-453d-9324-c6f5e8b49cc1", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557425", "uuid": "c9cddb6d-3412-4f69-bf1c-486a05974ab4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "md5", "timestamp": "1784557424", "to_ids": true, "type": "md5", "uuid": "39e00d1d-ee3f-4d04-997a-e65b47f57758", "value": "bf5519f3a462fc4d1b95235f61b55ee5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "sha1", "timestamp": "1784557425", "to_ids": true, "type": "sha1", "uuid": "38d2629f-ae78-4665-be5c-a5b03cc7ebc4", "value": "61edecadc9a62991d26aa17339895808140804ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "sha256", "timestamp": "1784557425", "to_ids": true, "type": "sha256", "uuid": "f5d840ad-7813-4cca-b562-fde969163a80", "value": "d651bc7e16cbee872f7df63e6072bd001dc20331cd1863f453ef4b07dadf475d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "text", "timestamp": "1784556497", "to_ids": false, "type": "text", "uuid": "505d248e-be5d-4747-928c-d382da27a004", "value": "Type Description: Win32 EXE\nOriginal name: wander.exe\nVerified: Signed\nSigning date: 03:26 AM 02/23/2025\nSigners: Shenzhen Xiangyou Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2025-03-12T07:38:59+00:00\nLast Submission: 2025-03-12T07:40:08+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "creation-time", "timestamp": "1784556497", "to_ids": false, "type": "datetime", "uuid": "efd4de4f-bd83-48cb-a389-bcf8650952ca", "value": "2089-09-11T00:11:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "ssdeep", "timestamp": "1784556497", "to_ids": true, "type": "ssdeep", "uuid": "2f2a5e8f-4362-48e7-be0d-3929284633a9", "value": "1536:iMICimXLWfFf49/hQCjNHBka1aiXu0WxKEOzeRT8e6IX700FMgwMCg:iMVDXR9/9NHaa1a2WxKEOzeRT8e6IX7t" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556497", "to_ids": false, "type": "size-in-bytes", "uuid": "69306277-4ca7-4b82-aa20-b08a5b2c2fd0", "value": "91720" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "vhash", "timestamp": "1784556497", "to_ids": true, "type": "vhash", "uuid": "fd842225-cca7-4d93-8227-24b456c27f60", "value": "29405f765516151160971251020" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-12T07:38:59+00:00", "last_seen": "2025-03-12T07:40:08+00:00", "object_relation": "filename", "timestamp": "1784556497", "to_ids": true, "type": "filename", "uuid": "36fd0a49-ea17-46a7-9451-9a421f36d589", "value": "wander.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557426", "uuid": "febbe393-034e-486f-aac1-25b46b84714d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "md5", "timestamp": "1784557426", "to_ids": true, "type": "md5", "uuid": "867e16da-461c-4230-9bf7-7ece93c2f98d", "value": "88d44d2fff8524190449f07d408d0fd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "sha1", "timestamp": "1784557426", "to_ids": true, "type": "sha1", "uuid": "2db09369-0ddc-4745-85b6-9d960a8c7622", "value": "46bc0497ee20d9460c5852fb53fc6a32f2752e00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "sha256", "timestamp": "1784557426", "to_ids": true, "type": "sha256", "uuid": "4d5e7660-b41f-4a1f-a471-41e8de48522f", "value": "006d604bab898fbefdf07815bf9165f68c14f8ce365e64a91cd43a6bcdff43a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "text", "timestamp": "1784556519", "to_ids": false, "type": "text", "uuid": "fe7c62b9-8f73-4bde-985b-2f9fd4a94485", "value": "Type Description: Win32 DLL\nOriginal name: xlbrowsershell.rc\nVerified: Signed\nSigning date: 01:18 PM 03/12/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2025-03-12T14:52:46+00:00\nLast Submission: 2025-04-05T09:05:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "creation-time", "timestamp": "1784556519", "to_ids": false, "type": "datetime", "uuid": "1a91f538-b374-4e16-aafc-2e130ca7cf36", "value": "2025-03-11T13:17:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "ssdeep", "timestamp": "1784556519", "to_ids": true, "type": "ssdeep", "uuid": "297498f1-2299-4eb3-995e-43ba96a126cf", "value": "12288:2i8fNlbU1ClPeigzzEKi9zUXXxttvHIuwf8G395Q5+h7z3hazThmo2spDnI:2i4l41W1Tp9Yxwuwf8Eh7DOThXXpDn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556519", "to_ids": false, "type": "size-in-bytes", "uuid": "cfa413e0-77aa-4d33-844c-63f8bdfe17ae", "value": "1241600" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "vhash", "timestamp": "1784556519", "to_ids": true, "type": "vhash", "uuid": "d9dc96c6-8a4f-462f-969e-df7b1f7fae6d", "value": "116096655d551d15167d5bz1tz17z43" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-12T14:52:46+00:00", "last_seen": "2025-04-05T09:05:05+00:00", "object_relation": "filename", "timestamp": "1784556519", "to_ids": true, "type": "filename", "uuid": "bc9196ab-8d6f-4b39-bb67-891c00d6478e", "value": "xlbrowsershell.rc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557427", "uuid": "6725c186-9f56-44e3-9902-14ad78f5edd6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "md5", "timestamp": "1784557427", "to_ids": true, "type": "md5", "uuid": "066e72a6-2590-468b-813f-b2afb6809912", "value": "d1a6e2beb0967c09109a4e4aef0e8ab1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "sha1", "timestamp": "1784557427", "to_ids": true, "type": "sha1", "uuid": "3bc10582-83e7-4fbc-981c-12d24f896960", "value": "ce4f1b67e57c5f7c3da25627a4f6ecb333e36a0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "sha256", "timestamp": "1784557427", "to_ids": true, "type": "sha256", "uuid": "0312dcb0-c743-4c93-a4ba-67960fecd802", "value": "0761f7c1774b5efbacebbdcf4f229cceff2fc48c8130a5958535a55774442fa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "text", "timestamp": "1784556541", "to_ids": false, "type": "text", "uuid": "e48b5f5b-9988-4934-8d84-7b425cc3ff1f", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 01:20 PM 03/13/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 39/74\nFirst Submission: 2025-03-13T15:09:09+00:00\nLast Submission: 2025-05-12T03:16:34+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "creation-time", "timestamp": "1784556542", "to_ids": false, "type": "datetime", "uuid": "28abce95-2536-4d5d-b363-d5219b06f985", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "ssdeep", "timestamp": "1784556541", "to_ids": true, "type": "ssdeep", "uuid": "248ed5fb-457b-44f9-85f3-ebb1603cefff", "value": "6144:0bW+2SlnU5mwXlJS/5pUvdKxX1Eciy6iaFU0Vyat9GIB5:cnlUbX/dKxXIDP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556541", "to_ids": false, "type": "size-in-bytes", "uuid": "463015f8-e3c9-4d1d-9685-543223c26146", "value": "317920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "vhash", "timestamp": "1784556541", "to_ids": true, "type": "vhash", "uuid": "adf2dc02-56e9-4588-9a5d-ab0e57ef146a", "value": "235036651512f081766800139" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-13T15:09:09+00:00", "last_seen": "2025-05-12T03:16:34+00:00", "object_relation": "filename", "timestamp": "1784556541", "to_ids": true, "type": "filename", "uuid": "ae39f260-0612-4fa3-a3bc-aec168eb0ca1", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557428", "uuid": "363f6a8d-d9be-429f-a93e-8617f3cfb6d4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "md5", "timestamp": "1784557428", "to_ids": true, "type": "md5", "uuid": "6396105e-8fcf-4167-9e8f-fe38d791a36b", "value": "ffff92a1aaaa42bf6e90c745bb3f65b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "sha1", "timestamp": "1784557428", "to_ids": true, "type": "sha1", "uuid": "c8fb19aa-51a3-4fbb-af86-c49bccf06469", "value": "cea64c0dd5e83356cb805215a21a63ad2bc0bde0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "sha256", "timestamp": "1784557428", "to_ids": true, "type": "sha256", "uuid": "af7a837d-0278-44d5-a5ae-f6892d20b2be", "value": "caefa709a7a0bb48657f0844b356651b5aa6b1d3b01b4c7a57b21942f8e4d651", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "text", "timestamp": "1784556564", "to_ids": false, "type": "text", "uuid": "10c4f4c1-8707-406e-9b8a-d80340ece01f", "value": "Type Description: Win32 EXE\nOriginal name: Python Application\nVerified: The digital signature of the object did not verify.\nSigning date: 12:10 AM 03/14/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 37/74\nFirst Submission: 2025-03-14T16:18:59+00:00\nLast Submission: 2025-08-07T05:52:13+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "creation-time", "timestamp": "1784556564", "to_ids": false, "type": "datetime", "uuid": "e24b2943-7e54-48ad-a52c-0bbd77eb463c", "value": "2021-10-04T11:12:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "ssdeep", "timestamp": "1784556564", "to_ids": true, "type": "ssdeep", "uuid": "3f36db28-b344-46ad-a856-fb61e6021105", "value": "12288:jRUwHRBlLOE2C2pEeYR8Ki+jssZM4eI2uEw6kZY2O6Nn+E:lTBlbEE5U+GREVXNnF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556564", "to_ids": false, "type": "size-in-bytes", "uuid": "952d4c60-6151-48bd-b3df-b94d4cfc0933", "value": "655496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "vhash", "timestamp": "1784556564", "to_ids": true, "type": "vhash", "uuid": "88fa4351-972e-4fb0-8ad1-0db46de195c5", "value": "265036751552f08176680013a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-14T16:18:59+00:00", "last_seen": "2025-08-07T05:52:13+00:00", "object_relation": "filename", "timestamp": "1784556564", "to_ids": true, "type": "filename", "uuid": "dd0af717-8f49-4245-8ded-a0ad5ed7ead5", "value": "Python Application" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557429", "uuid": "f8fd4f46-79fd-4357-8489-0969d4b629a0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "md5", "timestamp": "1784557429", "to_ids": true, "type": "md5", "uuid": "84e7967b-75c7-42ff-bee4-e506358bd83e", "value": "db751a8c754fa5fb22c480b74e3b2806", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "sha1", "timestamp": "1784557429", "to_ids": true, "type": "sha1", "uuid": "2f27c97b-32f5-44d1-b8cb-57cb303c844b", "value": "e6ba5eb49bea990204608081eb5a51a28649a470", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "sha256", "timestamp": "1784557429", "to_ids": true, "type": "sha256", "uuid": "d89c72f9-7f32-4655-a6f1-31ea6f10a768", "value": "d58859ddc52f98e48d32f47b000970ad03e807b8eeb3a1aae7d4af2721b43ecf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "text", "timestamp": "1784556585", "to_ids": false, "type": "text", "uuid": "22aabeeb-83b8-4e18-a681-c2827d9ae643", "value": "Type Description: Win32 EXE\nOriginal name: ntkrnlmp.exe\nVerified: Signed\nSigning date: 04:35 PM 03/15/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Zusy.SCA!MTB\nClamAV: None\nVT Total Detection: 41/74\nFirst Submission: 2025-03-15T17:18:15+00:00\nLast Submission: 2025-03-15T17:18:15+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "creation-time", "timestamp": "1784556585", "to_ids": false, "type": "datetime", "uuid": "f8d9e13f-9a0c-446b-bec8-a13bf6784d6e", "value": "2025-03-01T14:36:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "ssdeep", "timestamp": "1784556585", "to_ids": true, "type": "ssdeep", "uuid": "587ce087-3ac1-4a4b-ae01-89811a7a90da", "value": "6144:o3ZVy/W3lgxMsaxxpT6V8e8c2GZH0aI7VSI:o3l3wvI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556585", "to_ids": false, "type": "size-in-bytes", "uuid": "e1df96bd-77a9-42c2-a56c-796820fab4ba", "value": "296992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "vhash", "timestamp": "1784556585", "to_ids": true, "type": "vhash", "uuid": "cab53b19-b464-4e02-bf85-e6ce6435f718", "value": "225036651512f081966a00139" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-15T17:18:15+00:00", "last_seen": "2025-03-15T17:18:15+00:00", "object_relation": "filename", "timestamp": "1784556585", "to_ids": true, "type": "filename", "uuid": "af2a3c70-e34b-4e4d-8043-2eb1bdae6e85", "value": "ntkrnlmp.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557431", "uuid": "227e1fb8-e3e6-41a3-b3af-47cc9d535748", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "md5", "timestamp": "1784557430", "to_ids": true, "type": "md5", "uuid": "ac81bd49-6e32-4f7c-9696-ca5eea8f8360", "value": "5f252e8de68a7eecb2485bf6c110955d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "sha1", "timestamp": "1784557430", "to_ids": true, "type": "sha1", "uuid": "20c42295-d15d-43e8-a156-0a089e5ac6b2", "value": "7ca8228503a1e82b0b5878f6602e1c316fc3662f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "sha256", "timestamp": "1784557431", "to_ids": true, "type": "sha256", "uuid": "4ba00982-6738-409e-bb1a-4fc5b7c90bb9", "value": "1a4a0bbcb5b6a815d8bfe89bac30b68b2e4b7bad4995fe2674af0930b2e7757c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "text", "timestamp": "1784556607", "to_ids": false, "type": "text", "uuid": "0debefc8-3a62-4f92-81f1-703a45041623", "value": "Type Description: Win32 EXE\nOriginal name: PWA Identity Proxy\nVerified: The digital signature of the object did not verify.\nSigning date: 07:09 PM 03/14/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2025-03-15T12:15:05+00:00\nLast Submission: 2025-03-15T12:15:27+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "creation-time", "timestamp": "1784556607", "to_ids": false, "type": "datetime", "uuid": "b0816794-3fbd-4fc5-9c47-f2db453e0f0a", "value": "2025-02-14T16:55:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "ssdeep", "timestamp": "1784556607", "to_ids": true, "type": "ssdeep", "uuid": "1cd904af-4664-45e8-8fc9-1ef7a878cb95", "value": "6144:x24bIQ44W4XBPgZREFjj0zzMhOcJYS6eI6bMQCcc:fb1Bc7NJLipc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556607", "to_ids": false, "type": "size-in-bytes", "uuid": "f64345b0-47dc-4b21-ab6d-b4b72ab02774", "value": "300512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "vhash", "timestamp": "1784556607", "to_ids": true, "type": "vhash", "uuid": "bb408404-390b-4e09-8ed7-15a57cbefc51", "value": "235036651512f081866a00139" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-15T12:15:05+00:00", "last_seen": "2025-03-15T12:15:27+00:00", "object_relation": "filename", "timestamp": "1784556607", "to_ids": true, "type": "filename", "uuid": "add42349-8305-430c-9bf0-13f985d76c4c", "value": "PWA Identity Proxy" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557431", "uuid": "1b0efaff-e386-40c8-868a-e0053e9ad27b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "md5", "timestamp": "1784557431", "to_ids": true, "type": "md5", "uuid": "1b33998b-0b35-4a18-bb01-32fcd4288167", "value": "7b421945615d78608971fa64c033013f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "sha1", "timestamp": "1784557431", "to_ids": true, "type": "sha1", "uuid": "4c17a4a0-a283-4f70-b10c-445ea1a68d45", "value": "4fc83dac6f948aa4a30a82227830273b5b10fa9b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "sha256", "timestamp": "1784557431", "to_ids": true, "type": "sha256", "uuid": "0f92a9f1-aa46-4c62-802e-aa4df8c37643", "value": "b28012e33e16bd578af103b630e485c84a04da8d86f941e59f1d1e4944bf123e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "text", "timestamp": "1784556628", "to_ids": false, "type": "text", "uuid": "312ee7d9-174c-49ca-a041-66dd545250f5", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 01:38 PM 03/15/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2025-03-16T02:56:44+00:00\nLast Submission: 2025-03-20T10:20:27+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "creation-time", "timestamp": "1784556628", "to_ids": false, "type": "datetime", "uuid": "844d64f4-a2ad-4b2b-bb8e-0a66a9e84b37", "value": "2025-03-15T02:55:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "ssdeep", "timestamp": "1784556628", "to_ids": true, "type": "ssdeep", "uuid": "699fb5d5-637e-4912-acbb-4f4fcaee41fb", "value": "384:9SNyb8E9VFzSJIVkicc9ny1Wo1cs+Nxicc9nyqvrSJIVE8E9VF0Ny9d:4Es269p6R2EB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556628", "to_ids": false, "type": "size-in-bytes", "uuid": "8e4bd57b-a09b-4677-b393-e347a7dcfa54", "value": "20512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "vhash", "timestamp": "1784556628", "to_ids": true, "type": "vhash", "uuid": "05094c20-8514-4cea-9b69-961531f2ba47", "value": "124046151d151bz2?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:56:44+00:00", "last_seen": "2025-03-20T10:20:27+00:00", "object_relation": "filename", "timestamp": "1784556628", "to_ids": true, "type": "filename", "uuid": "aaa60d32-7fd0-429d-86d0-6fc562592297", "value": "b28012e33e16bd578af103b630e485c84a04da8d86f941e59f1d1e4944bf123e.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557433", "uuid": "0e493cee-ad55-46ec-b390-e48b48847eb5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "md5", "timestamp": "1784557433", "to_ids": true, "type": "md5", "uuid": "c0c9f098-a88f-4f2e-a153-55c84ffd442a", "value": "dde501ba2aa5812e5ee9946dcec3775c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "sha1", "timestamp": "1784557433", "to_ids": true, "type": "sha1", "uuid": "3247d746-817f-4b11-8429-0f1a9199815a", "value": "ff43fab80c63390f3c302bb37baa2bd4d33b7185", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "sha256", "timestamp": "1784557433", "to_ids": true, "type": "sha256", "uuid": "c32668d2-b269-49b2-a8f1-9fd5399e4e05", "value": "12650308c96a8634e1ff0a24ceeb8e4d948093188b6693062244eae3479a7c49", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "text", "timestamp": "1784556650", "to_ids": false, "type": "text", "uuid": "6979bb4c-3e81-4a2f-8a2c-ed2299bdd4a0", "value": "Type Description: Win32 DLL\nVerified: Signed\nSigning date: 01:36 PM 03/15/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 47/74\nFirst Submission: 2025-03-16T02:56:52+00:00\nLast Submission: 2025-03-16T02:56:52+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "creation-time", "timestamp": "1784556650", "to_ids": false, "type": "datetime", "uuid": "b6906b3c-a3cc-47b3-8945-8cf7ad7f0282", "value": "2023-05-13T02:31:05+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "ssdeep", "timestamp": "1784556650", "to_ids": true, "type": "ssdeep", "uuid": "55efce88-c587-4c14-9f3a-cfd4876ea007", "value": "24576:TpooLM/J/G0JSNK5vn4jKx77ocnFJnhAInaM9xM5AZBmSFXP1WBS43ZNQpUuBmpC:vMVGyR4jer5bcqZ4SFXaS43mUFpGB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556650", "to_ids": false, "type": "size-in-bytes", "uuid": "ca25664c-90c4-4843-8cb4-5199a5ddfa62", "value": "2406952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "vhash", "timestamp": "1784556650", "to_ids": true, "type": "vhash", "uuid": "3dd731af-352c-4bd3-9395-4224eea8862a", "value": "1260a6666d5c0d5d1555103232z5e002b7z8035z23z303bz35" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:56:52+00:00", "last_seen": "2025-03-16T02:56:52+00:00", "object_relation": "filename", "timestamp": "1784556650", "to_ids": true, "type": "filename", "uuid": "35d46d3d-7713-4231-82d8-b5901c0bd3bb", "value": "commonbase.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557434", "uuid": "a4536955-f3e6-464d-a576-150262d2cbcf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "md5", "timestamp": "1784557433", "to_ids": true, "type": "md5", "uuid": "d2fd9bc7-804f-464d-9f3c-c21476698401", "value": "8eb61719c5a7319923729f8f366264b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "sha1", "timestamp": "1784557434", "to_ids": true, "type": "sha1", "uuid": "51d3cb98-6bf6-404c-a153-d9a23fa02dce", "value": "532cd4ef5c010374b16f37dc1313081be841a23e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "sha256", "timestamp": "1784557434", "to_ids": true, "type": "sha256", "uuid": "e4e946be-73c1-43a5-812c-32ce1befddf8", "value": "422d8d1f652be8790b7b54cc2e05d67f8b1b94e74da9dd6b3733c8968171447b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "text", "timestamp": "1784556671", "to_ids": false, "type": "text", "uuid": "a09ebe59-ede5-4bd6-8fbd-72c5eaf2fc24", "value": "Type Description: Win32 EXE\nOriginal name: ntkrnlmp.exe\nVerified: The digital signature of the object did not verify.\nSigning date: 04:19 PM 03/15/2025\nSigners: Hena Luxion Network Technology Co., Ltd.; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: Trojan:MSIL/Zusy!MTB\nClamAV: None\nVT Total Detection: 42/74\nFirst Submission: 2025-03-16T02:35:20+00:00\nLast Submission: 2025-03-16T02:35:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "creation-time", "timestamp": "1784556671", "to_ids": false, "type": "datetime", "uuid": "a04c7f66-40e9-43da-8fcc-a22c1aa7ff0f", "value": "2025-03-01T14:36:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "ssdeep", "timestamp": "1784556671", "to_ids": true, "type": "ssdeep", "uuid": "782d5230-47ed-44f6-82b2-6ff89fc88c97", "value": "6144:93ZVy/W3lgxMsaxxpT6V8e8c2GZH0aI7VSN:93l3wv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556671", "to_ids": false, "type": "size-in-bytes", "uuid": "dbf758db-48e3-4c59-8198-6cfe4833b8cb", "value": "298176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "vhash", "timestamp": "1784556671", "to_ids": true, "type": "vhash", "uuid": "3141fe66-d598-465a-bd5b-7eb51f5a83e3", "value": "225036651512f081966a00139" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T02:35:20+00:00", "last_seen": "2025-03-16T02:35:20+00:00", "object_relation": "filename", "timestamp": "1784556671", "to_ids": true, "type": "filename", "uuid": "d7465e09-103e-4472-a4b8-1d0317851fcb", "value": "ntkrnlmp.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557435", "uuid": "e9b52a64-162b-4215-b3da-ed14e34f658c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "md5", "timestamp": "1784557434", "to_ids": true, "type": "md5", "uuid": "dad07961-1588-46df-82af-0e5aa74164bb", "value": "8ce6bfd3fe3f3a3fd38ba9825f69c108", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "sha1", "timestamp": "1784557434", "to_ids": true, "type": "sha1", "uuid": "a541f42e-0868-44e2-9ce6-481d08c8e99c", "value": "7789ccbe420f5a1d77430e6d2f3b9acc0cfd2a01", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "sha256", "timestamp": "1784557435", "to_ids": true, "type": "sha256", "uuid": "3c926ae5-df8e-4055-9787-aab80c7d2151", "value": "5a0db0a91b174486fef85831b2c57fbeec88ee7228b3651214ac715cb7b44e65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "text", "timestamp": "1784556693", "to_ids": false, "type": "text", "uuid": "f4a6ffdb-a638-4160-b805-3116a5a64bfb", "value": "Type Description: Win32 DLL\nOriginal name: agora_rtc_sdk.dll\nVerified: Signed\nSigning date: 06:50 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:42+00:00\nLast Submission: 2025-08-31T09:22:34+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "creation-time", "timestamp": "1784556693", "to_ids": false, "type": "datetime", "uuid": "239991ce-adc1-41e9-83eb-a02c8d63d051", "value": "2023-05-25T07:19:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "ssdeep", "timestamp": "1784556693", "to_ids": true, "type": "ssdeep", "uuid": "8f916bf0-845f-4c89-832c-390a250b3f49", "value": "393216:eigN55ODC3ZeKw+6Br9tWaQAqPXcymkrgyP:ei+fEtWqXu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556693", "to_ids": false, "type": "size-in-bytes", "uuid": "76afbced-df81-4984-8732-0fbb31c8662a", "value": "32031096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "vhash", "timestamp": "1784556693", "to_ids": true, "type": "vhash", "uuid": "447b6e19-7d78-463f-94c4-db96368c7a76", "value": "13709666556d556515551083z40600cc7za0601031z10200262z1425z250" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:42+00:00", "last_seen": "2025-08-31T09:22:34+00:00", "object_relation": "filename", "timestamp": "1784556693", "to_ids": true, "type": "filename", "uuid": "c4562be9-1dbf-42c0-9478-cf0820a579f6", "value": "agora_rtc_sdk.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557436", "uuid": "bda45f4c-cfd4-4aaa-b52e-862f7b85dbaa", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "md5", "timestamp": "1784557436", "to_ids": true, "type": "md5", "uuid": "e476c839-3d58-45f2-bda0-a9ccddc6ad3e", "value": "714fe7d7f2e4cf77dbd0bc33407d6f6f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "sha1", "timestamp": "1784557436", "to_ids": true, "type": "sha1", "uuid": "8e21f2fd-63c2-458d-bc3f-b1bd325744d2", "value": "16f0a957b3a5363ef4fb8c6d7d9251279f273464", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "sha256", "timestamp": "1784557436", "to_ids": true, "type": "sha256", "uuid": "59f4ad05-d4d0-47d6-93e7-c13a52bacf60", "value": "f8f8c2fad5f64e4ff471155bbd06bdf465abdf6a637e2acb5ce535e6f31620ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "text", "timestamp": "1784556714", "to_ids": false, "type": "text", "uuid": "eec19484-e5d8-43f0-8073-26394d9ebcf0", "value": "Type Description: Win32 DLL\nOriginal name: libagora_ai_echo_cancellation_extension.dll\nVerified: Signed\nSigning date: 06:52 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:41+00:00\nLast Submission: 2025-08-07T05:53:08+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "creation-time", "timestamp": "1784556714", "to_ids": false, "type": "datetime", "uuid": "d5514664-bedb-4cc9-9992-3982b26d16e2", "value": "2023-05-25T07:19:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "ssdeep", "timestamp": "1784556714", "to_ids": true, "type": "ssdeep", "uuid": "3338a6e0-bd62-4ef5-bb4c-bc63237f3c6d", "value": "98304:+PuNUCJqyYme634JyeVJXnKCqS5ESTmpFx:eu+CJPT7XCN6STsj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556714", "to_ids": false, "type": "size-in-bytes", "uuid": "3b66b2bc-2e5a-4563-8506-dbf18ffb02e0", "value": "4056440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "vhash", "timestamp": "1784556714", "to_ids": true, "type": "vhash", "uuid": "7602bb71-0bb4-4a37-bed9-0e3623ed94f7", "value": "146076655d755555155az4a!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:53:08+00:00", "object_relation": "filename", "timestamp": "1784556714", "to_ids": true, "type": "filename", "uuid": "2eb708f9-759f-4891-91b3-3f9215713ea9", "value": "libagora_ai_echo_cancellation_extension.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557437", "uuid": "91242bc5-5f26-46d2-99c9-82abd2f1daaf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "md5", "timestamp": "1784557437", "to_ids": true, "type": "md5", "uuid": "f57a960c-7612-45f9-bbc1-c2abaa31a9bd", "value": "2e146625090162295d8557f8c5a93643", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "sha1", "timestamp": "1784557437", "to_ids": true, "type": "sha1", "uuid": "4e819283-c7f8-42fe-ba0b-7bd0599e4911", "value": "34a3276d29107371e127d577fb39c9dc97fffb5c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "sha256", "timestamp": "1784557437", "to_ids": true, "type": "sha256", "uuid": "830f50f7-d391-4dcf-8c15-702f39d3d3b8", "value": "d3d1530c11f95931375522d774a592f566f09091d89f95e96c785f3731295b5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "text", "timestamp": "1784556736", "to_ids": false, "type": "text", "uuid": "81762d02-60c9-4064-aa58-cf865fc8ff78", "value": "Type Description: Win32 DLL\nOriginal name: libagora-wgc.dll\nVerified: Signed\nSigning date: 06:52 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:40+00:00\nLast Submission: 2025-08-07T05:52:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "creation-time", "timestamp": "1784556736", "to_ids": false, "type": "datetime", "uuid": "57ffe55b-51cc-44c4-9bc4-32de89ddf7b2", "value": "2022-12-13T03:34:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "ssdeep", "timestamp": "1784556736", "to_ids": true, "type": "ssdeep", "uuid": "85b18b3b-99eb-4875-ad66-b6f60b485f2c", "value": "24576:2b+DtjYROnFG3H+2oDJ3QVp9zwO4yG6mm:W0jYQFG3vmJ3E9zh4ybmm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556736", "to_ids": false, "type": "size-in-bytes", "uuid": "9687eca3-4069-4b11-b17e-4651f9b03865", "value": "2281336" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "vhash", "timestamp": "1784556736", "to_ids": true, "type": "vhash", "uuid": "3f806f95-82c4-495c-8a55-34414a5806cc", "value": "1260b6551d15551d15151az897z105bz4eza" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:52:25+00:00", "object_relation": "filename", "timestamp": "1784556736", "to_ids": true, "type": "filename", "uuid": "22c6fc02-eafc-497e-ac43-073d78fca0f0", "value": "libagora-wgc.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557439", "uuid": "209bf3ac-2110-4059-a551-1c298b01b45e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "md5", "timestamp": "1784557438", "to_ids": true, "type": "md5", "uuid": "32b898dd-1b88-4886-b73d-106982774864", "value": "bcfd6aad300ddb43b3caa9818d62b123", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "sha1", "timestamp": "1784557438", "to_ids": true, "type": "sha1", "uuid": "5f99fabb-adfb-4199-a6ae-29ccd085b49f", "value": "36d57e7ffa505cd892039f8e94aa16ece4fd6a05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "sha256", "timestamp": "1784557439", "to_ids": true, "type": "sha256", "uuid": "390e994a-8986-4159-a2ee-dbe05d98206f", "value": "c63605edf94bf8e3003e123e378d861640c4b816c34542681336e06d1b07a677", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "text", "timestamp": "1784556758", "to_ids": false, "type": "text", "uuid": "ad30949c-41b2-4fd1-a00c-18d1ba11be93", "value": "Type Description: Win32 DLL\nOriginal name: libagora_video_quality_analyzer_extension.dll\nVerified: Signed\nSigning date: 06:53 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:41+00:00\nLast Submission: 2025-08-07T05:48:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "creation-time", "timestamp": "1784556758", "to_ids": false, "type": "datetime", "uuid": "4c82dd29-cc4b-4fe3-8f8d-de78c30124fe", "value": "2023-05-25T07:19:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "ssdeep", "timestamp": "1784556758", "to_ids": true, "type": "ssdeep", "uuid": "ff60e68e-736b-4837-bf8d-88c978511b1a", "value": "24576:PweY8RvXPqeF42mExft7CAs+VimYx1PonXA8Dly5:PweY8RvXSeF43Exft5s+c6XAB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556758", "to_ids": false, "type": "size-in-bytes", "uuid": "522345cf-a15c-4a48-89a4-fed9d4fb4890", "value": "1046904" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "vhash", "timestamp": "1784556758", "to_ids": true, "type": "vhash", "uuid": "57bab4e9-a434-4fc8-878a-3db3b21f33ec", "value": "116076655d655555155az4b!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:48:59+00:00", "object_relation": "filename", "timestamp": "1784556758", "to_ids": true, "type": "filename", "uuid": "d6a8d947-2533-4952-a8b6-c8190b2e45e3", "value": "libagora_video_quality_analyzer_extension.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557440", "uuid": "50626204-3715-4726-a198-096fd66f6a95", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "md5", "timestamp": "1784557440", "to_ids": true, "type": "md5", "uuid": "6160c600-7262-4de4-8bc5-0fc145f7cbbe", "value": "5b3422e5d5238e627386bca5c2d5532e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "sha1", "timestamp": "1784557440", "to_ids": true, "type": "sha1", "uuid": "77d07345-64d0-4ec3-9f47-2e008545276a", "value": "53987dd616ae314674e5c16ab9dc8d6c128898c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "sha256", "timestamp": "1784557440", "to_ids": true, "type": "sha256", "uuid": "6a147977-37a4-42e1-9995-b18daefc656b", "value": "bffcb05ec71980edf671aaa4bbe833cf85b9448c2f83acebb6aa69f083567904", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "text", "timestamp": "1784556779", "to_ids": false, "type": "text", "uuid": "b5a3dc93-7a6a-498c-8ba4-6927b04eec91", "value": "Type Description: Win32 DLL\nOriginal name: libagora_screen_capture_extension.dll\nVerified: Signed\nSigning date: 06:52 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:40+00:00\nLast Submission: 2025-08-07T05:47:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "creation-time", "timestamp": "1784556779", "to_ids": false, "type": "datetime", "uuid": "baa3e19d-8e26-4b4a-9145-c0370cae781a", "value": "2023-05-25T07:20:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "ssdeep", "timestamp": "1784556779", "to_ids": true, "type": "ssdeep", "uuid": "82121a85-cb72-4bae-a485-cd74658aa068", "value": "6144:HzXKl94i5F+DchsGQkolGW9mIud1OupfUVOajj2Ppv5TyplvCdmHeXMOjsIwcoht:HCLUFb9SfMCPB5TyplO2coymMcB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556779", "to_ids": false, "type": "size-in-bytes", "uuid": "92963569-40a2-42b3-be22-daee4c8b8eac", "value": "656760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "vhash", "timestamp": "1784556779", "to_ids": true, "type": "vhash", "uuid": "7d55c342-0101-4981-a7a3-bd5d6f3855f6", "value": "165076655d155515155034z1100697z403023z22z443z39z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:47:47+00:00", "object_relation": "filename", "timestamp": "1784556779", "to_ids": true, "type": "filename", "uuid": "0d54ea04-6a5b-4412-85c3-d870c7555b6c", "value": "libagora_screen_capture_extension.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557442", "uuid": "c54ac682-a6f5-4b14-ba68-28b91fd5d78f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "md5", "timestamp": "1784557442", "to_ids": true, "type": "md5", "uuid": "5b4bb2e9-3741-462f-814c-347113a88ff3", "value": "b45283b4927900485791225db8b0bf48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "sha1", "timestamp": "1784557442", "to_ids": true, "type": "sha1", "uuid": "a1af0115-fdb8-4a39-adec-f58cd7752e43", "value": "30c4a5c157af0c1b5a2c1766f3309c46f7b5bee3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "sha256", "timestamp": "1784557442", "to_ids": true, "type": "sha256", "uuid": "69008597-5c27-4b46-aed6-0f67a47de481", "value": "b26bef3a5523f910deff1f4429c30019b64cabfc82c0d89d4f1524886ff6c364", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "text", "timestamp": "1784556802", "to_ids": false, "type": "text", "uuid": "59c87edd-6069-42bf-a687-04bfcaa53f0e", "value": "Type Description: Win32 DLL\nOriginal name: libagora_video_encoder_extension.dll\nVerified: Signed\nSigning date: 06:53 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:41+00:00\nLast Submission: 2025-08-07T05:46:53+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "creation-time", "timestamp": "1784556802", "to_ids": false, "type": "datetime", "uuid": "26895d1f-4074-4a82-844d-b751eae34881", "value": "2023-05-25T07:20:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "ssdeep", "timestamp": "1784556802", "to_ids": true, "type": "ssdeep", "uuid": "1ba45a11-b934-4f67-8a1d-3fdcd71d6347", "value": "24576:XSaJntyPFiKSHLj994vwmVssRjH42q5uY7AqaLB1GRzJ9lGW3WoKTkSbxNmaLwev:XxyonIbFG2yu9TGRzJGMdSbxjLQh2lJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556802", "to_ids": false, "type": "size-in-bytes", "uuid": "9dff2721-c89b-4d20-8c7c-4394ba863502", "value": "2029944" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "vhash", "timestamp": "1784556802", "to_ids": true, "type": "vhash", "uuid": "e1369050-1678-47bc-b092-b7170df57818", "value": "126076655d156515155018z6a9z1hz3015z1c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:53+00:00", "object_relation": "filename", "timestamp": "1784556802", "to_ids": true, "type": "filename", "uuid": "dd516a03-9108-4c46-b0d5-5b72f052dea6", "value": "libagora_video_encoder_extension.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557444", "uuid": "0e25deca-d181-439f-9740-a08a35269451", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "md5", "timestamp": "1784557444", "to_ids": true, "type": "md5", "uuid": "f670edc6-e90f-4981-93e5-767c1178853f", "value": "40e3c0707ae44f18dee5a9a26a5783cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "sha1", "timestamp": "1784557444", "to_ids": true, "type": "sha1", "uuid": "9b928176-6349-4541-80c7-b4d8e405609f", "value": "bbd2ee4822f80106c5ef61818d8e959cc4e1c281", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "sha256", "timestamp": "1784557444", "to_ids": true, "type": "sha256", "uuid": "ad073f25-9e4b-4f2f-a692-5cd482828e6c", "value": "a110a5e48e6cba92f98d561306762a58952234b6da62b445892a47d47c0d0772", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "text", "timestamp": "1784556824", "to_ids": false, "type": "text", "uuid": "157ab1e7-a50c-4604-a978-665e51bf81ee", "value": "Type Description: Win32 DLL\nOriginal name: agorartc.dll\nVerified: Signed\nSigning date: 06:50 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:39+00:00\nLast Submission: 2025-08-07T05:46:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "creation-time", "timestamp": "1784556824", "to_ids": false, "type": "datetime", "uuid": "03b33783-ca1c-4d97-b233-25519ea6e23b", "value": "2094-11-09T01:32:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "ssdeep", "timestamp": "1784556824", "to_ids": true, "type": "ssdeep", "uuid": "695b8f3c-087b-4858-a6a2-15054a7f34e2", "value": "12288:V2kvnJC1RYazXfFzo6omwzX3buwVoAtOymeaj5Y:V2kvnJC1RYGXfNJomwz3buwVoAtOyme9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556824", "to_ids": false, "type": "size-in-bytes", "uuid": "12e9da2b-f0de-413e-a6da-1b4b25f7b2fb", "value": "555384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "vhash", "timestamp": "1784556824", "to_ids": true, "type": "vhash", "uuid": "39e442a8-4608-409b-8ce3-b9dd522823dc", "value": "155026551\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:20+00:00", "object_relation": "filename", "timestamp": "1784556824", "to_ids": true, "type": "filename", "uuid": "0e361f74-123a-438b-95bf-a2db2c3c68bf", "value": "agorartc.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557445", "uuid": "30578609-d7a2-4b09-bfab-65d99da6c9e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "md5", "timestamp": "1784557444", "to_ids": true, "type": "md5", "uuid": "d1f2cac5-aaa8-4225-8b65-bb8285040e77", "value": "fe9ff9feb81109b4e2643d22c4bc9fc9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "sha1", "timestamp": "1784557445", "to_ids": true, "type": "sha1", "uuid": "ffe81464-6068-4054-a836-2ffd8617874d", "value": "76cc7f23857dadc1aee692bb6f541f345c8c966d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "sha256", "timestamp": "1784557445", "to_ids": true, "type": "sha256", "uuid": "b8270a1c-002f-4858-aafc-24e99efb5fdd", "value": "a038d896f221c220d84719c489b9444f9fadccc46f72ed9f2e505f7dbfad7029", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "text", "timestamp": "1784556845", "to_ids": false, "type": "text", "uuid": "080f856e-08d3-46e5-bfc7-6facf84d5d51", "value": "Type Description: Win32 DLL\nOriginal name: libagora-ffmpeg\nVerified: Signed\nSigning date: 06:52 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:41+00:00\nLast Submission: 2025-08-07T05:46:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "creation-time", "timestamp": "1784556845", "to_ids": false, "type": "datetime", "uuid": "f65f6cde-54e5-45d5-9493-748e3ef46b9d", "value": "2023-05-25T07:19:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "ssdeep", "timestamp": "1784556845", "to_ids": true, "type": "ssdeep", "uuid": "7dd5a66a-2a18-4c2a-956e-6443e1e719fa", "value": "98304:FyCnqV3goxMXoaYxYCVmOCMRQ+jK9nVNeKnshsJ330meO1vSD:uRVmOCMRQ+wqgkmeOE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556845", "to_ids": false, "type": "size-in-bytes", "uuid": "2442fd15-d22d-4979-aa28-36b551ab7ddc", "value": "7780216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "vhash", "timestamp": "1784556845", "to_ids": true, "type": "vhash", "uuid": "007234c0-c7b7-4fb7-a0e2-43b275931bf2", "value": "176076655d156515155068z74tz11f5zb8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:46:11+00:00", "object_relation": "filename", "timestamp": "1784556845", "to_ids": true, "type": "filename", "uuid": "1bb3b258-10e9-4666-b94e-0b9750e1a38c", "value": "libagora-ffmpeg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557446", "uuid": "eb94869f-e255-49aa-af69-c8bb28b1d2c9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "md5", "timestamp": "1784557446", "to_ids": true, "type": "md5", "uuid": "c7582421-dc2c-4f4f-a9a6-5cb8bebfa0ca", "value": "ddd19f8967e9074a454cb9e384909861", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "sha1", "timestamp": "1784557446", "to_ids": true, "type": "sha1", "uuid": "2cd30f95-4977-45a9-a46e-31a4b6fd37f1", "value": "d18b9f8706192b125f5063a382701ba1e0cbb33f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "sha256", "timestamp": "1784557446", "to_ids": true, "type": "sha256", "uuid": "05b49283-b77e-4655-a819-a189bb2aded6", "value": "51324954ae757cd1b9208be4c4e64b3ffc6adc2549cfc24e001c8631292154c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "text", "timestamp": "1784556867", "to_ids": false, "type": "text", "uuid": "2d1bd421-5a32-4011-981b-b4c8a79e8e3a", "value": "Type Description: Win32 EXE\nOriginal name: iTourTranslator.dll\nVerified: Signed\nSigning date: 06:52 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:39+00:00\nLast Submission: 2025-08-07T05:46:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "creation-time", "timestamp": "1784556867", "to_ids": false, "type": "datetime", "uuid": "eda7033a-e8ef-4d5b-846b-a6609ed32d12", "value": "2024-06-14T08:32:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "ssdeep", "timestamp": "1784556867", "to_ids": true, "type": "ssdeep", "uuid": "5cc8a0e5-71aa-46d8-a8e6-548f48c0b75c", "value": "3072:k5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4FULC4o212Jxa/v:kBKjK2LFzZNf+UL9PAo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556867", "to_ids": false, "type": "size-in-bytes", "uuid": "ad18d0cf-dcc1-4d52-a9e7-a537e7382821", "value": "178040" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "vhash", "timestamp": "1784556867", "to_ids": true, "type": "vhash", "uuid": "4e48933f-e26d-46a1-8bc9-adc6a1b6e217", "value": "015076651d155515555068z32hz13z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:39+00:00", "last_seen": "2025-08-07T05:46:09+00:00", "object_relation": "filename", "timestamp": "1784556867", "to_ids": true, "type": "filename", "uuid": "cbf3981e-454b-4e50-a4b7-252ccba7418f", "value": "iTourTranslator.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557447", "uuid": "a0fa10da-ad82-4c6e-94cd-f8217864cc85", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "md5", "timestamp": "1784557447", "to_ids": true, "type": "md5", "uuid": "b66f5b88-d54b-4291-8d3b-33ea86508a61", "value": "06f898268f06f563994d3c6d80a073a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "sha1", "timestamp": "1784557447", "to_ids": true, "type": "sha1", "uuid": "25de756c-afba-4d7e-ad91-0b237a66c33e", "value": "89eb854f56377c136338f307d90d60a5f736b783", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "sha256", "timestamp": "1784557447", "to_ids": true, "type": "sha256", "uuid": "fca61dc5-7999-4484-ab46-1240f0f23ae2", "value": "6659463f5818876450d98d81a1559e1691f8750f5cf46f8cc99dd60d7c29e549", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "text", "timestamp": "1784556889", "to_ids": false, "type": "text", "uuid": "c1508dc4-878b-4884-b485-67e35db00dae", "value": "Type Description: Win32 DLL\nOriginal name: libmp3lame.dll\nVerified: Signed\nSigning date: 06:53 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:41+00:00\nLast Submission: 2025-08-07T05:44:29+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "creation-time", "timestamp": "1784556889", "to_ids": false, "type": "datetime", "uuid": "e6d6ab90-308d-47b7-9392-a352cf9372e3", "value": "2017-10-22T12:00:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "ssdeep", "timestamp": "1784556889", "to_ids": true, "type": "ssdeep", "uuid": "f006b11c-e602-4afa-ab8d-0f7ae11dc86d", "value": "24576:CvjRgy7NdlnlVCbwuWafxtS2SomEMgSY+F:CVgy7Ndlnl3u9f4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556889", "to_ids": false, "type": "size-in-bytes", "uuid": "095ba3a0-401f-4270-9cd1-1ef076bfdb01", "value": "1095032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "vhash", "timestamp": "1784556889", "to_ids": true, "type": "vhash", "uuid": "a14ec349-61c7-4acf-9d74-5e0c2ef8e1cc", "value": "1160a6656d55551515151az4a=zdc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:41+00:00", "last_seen": "2025-08-07T05:44:29+00:00", "object_relation": "filename", "timestamp": "1784556889", "to_ids": true, "type": "filename", "uuid": "a5e7b3cb-c908-4495-ba10-fdea75e0365f", "value": "libmp3lame.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557449", "uuid": "da7c2e01-4efb-434e-9e69-7083500d8fb4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "md5", "timestamp": "1784557449", "to_ids": true, "type": "md5", "uuid": "9edf6302-39f2-405b-afd7-aa76928d42ab", "value": "6cde96c963eb29117962abceb91b4efb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "sha1", "timestamp": "1784557449", "to_ids": true, "type": "sha1", "uuid": "178ba751-69f2-480e-afb7-1b7d621720f7", "value": "dfbfc3aaaa16a8960a78c14046440977618f3661", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "sha256", "timestamp": "1784557449", "to_ids": true, "type": "sha256", "uuid": "c75d9d76-43e1-487f-9643-3b0331776b09", "value": "06114593f23b93d1d9c9f42da1cddb118c0ed09d168e442ece51a3ca66c0b82d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "text", "timestamp": "1784556910", "to_ids": false, "type": "text", "uuid": "0e19186e-4d55-49e3-ba94-31028db4b483", "value": "Type Description: Win32 DLL\nOriginal name: libagora-fdkaac.dll\nVerified: Signed\nSigning date: 06:52 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-03-16T05:00:40+00:00\nLast Submission: 2025-08-07T05:44:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "creation-time", "timestamp": "1784556911", "to_ids": false, "type": "datetime", "uuid": "4d24b581-e9f4-4cd9-9d27-7e1bc70b8517", "value": "2023-05-25T07:12:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "ssdeep", "timestamp": "1784556910", "to_ids": true, "type": "ssdeep", "uuid": "6ea7a414-bda0-48eb-8063-f580f5c58f3a", "value": "24576:YksHBSOOSz8Mtr/g3TpB++3USbLdTP6Kv+dA5:YksPz8MtrgpZkSbNnx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556910", "to_ids": false, "type": "size-in-bytes", "uuid": "8e767b54-89e2-4296-995c-ef3c273ec693", "value": "800120" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "vhash", "timestamp": "1784556910", "to_ids": true, "type": "vhash", "uuid": "712db6e4-a7b6-4561-83fb-c5ff3b722b00", "value": "185076656d155515155az44?zd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:40+00:00", "last_seen": "2025-08-07T05:44:28+00:00", "object_relation": "filename", "timestamp": "1784556910", "to_ids": true, "type": "filename", "uuid": "ed6cdccf-4497-4f11-a7da-24f447646865", "value": "libagora-fdkaac.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784557450", "uuid": "cb13c0de-8b26-49af-b01a-9aaf410f4c73", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "md5", "timestamp": "1784557450", "to_ids": true, "type": "md5", "uuid": "fe45ce38-dccd-48b6-966f-f4fe70cf14e5", "value": "44e82bb9350d6f6ce015d2d3368206fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "sha1", "timestamp": "1784557450", "to_ids": true, "type": "sha1", "uuid": "ff2893ac-7fdb-4b1c-8e85-172a42a21756", "value": "a2c5c57e8cdfdc54910b9afc30dd8c962983ad05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "sha256", "timestamp": "1784557450", "to_ids": true, "type": "sha256", "uuid": "09e58332-7223-418d-a154-c33c99f791ce", "value": "69255dbf914a19e039b7ea42aa8e06119200e2ad848f62b37b277438be745967", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "text", "timestamp": "1784556932", "to_ids": false, "type": "text", "uuid": "db48dee1-7fac-4fa6-b4b1-da7126e9c6ea", "value": "Type Description: Win32 DLL\nOriginal name: GPTAssistant.dll\nVerified: Signed\nSigning date: 06:51 AM 02/27/2025\nSigners: \u5408\u80a5\u4eb2\u7231\u7684\u8bd1\u5b98\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2025-03-16T05:00:32+00:00\nLast Submission: 2025-08-07T05:43:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "creation-time", "timestamp": "1784556932", "to_ids": false, "type": "datetime", "uuid": "16d077f8-675b-4058-b845-7cbe4c9f5f8d", "value": "2104-05-18T09:10:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "ssdeep", "timestamp": "1784556932", "to_ids": true, "type": "ssdeep", "uuid": "886d1d0c-69d7-49e3-9240-ab4222a822fb", "value": "12288:mynJLCxIgYwaUcKFMM/1d/T0gTj6HXTXVNVpBK4pMo25N+FgVz:mynJLCxIgYwaUDF//1d/T0gTj6HXTXVO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784556932", "to_ids": false, "type": "size-in-bytes", "uuid": "78d8ef75-e0f8-42f8-a04c-73cca07424ec", "value": "609144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "vhash", "timestamp": "1784556932", "to_ids": true, "type": "vhash", "uuid": "ea49dcc3-163e-4448-9070-cc26113a9522", "value": "165056060665167\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-16T05:00:32+00:00", "last_seen": "2025-08-07T05:43:43+00:00", "object_relation": "filename", "timestamp": "1784556932", "to_ids": true, "type": "filename", "uuid": "46bcfbca-4448-4f71-b712-0685df9ec24b", "value": "GPTAssistant.dll" } ] } ] } }