{ "Event": { "analysis": "1", "date": "2026-07-09", "extends_uuid": "", "info": "[Threat Intel] Massive offensive launched on Russian businesses", "protected": false, "publish_timestamp": "1784408117", "published": true, "threat_level_id": "2", "timestamp": "1784408117", "uuid": "be68b329-748d-4147-8f8f-2d20d6393aa9", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#f4b62b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"", "relationship_type": "" }, { "colour": "#280b0e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#44b2c2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": "" }, { "colour": "#bd512b", "local": false, "name": "misp-galaxy:target-information=\"Belarus\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"NetSupport Manager\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681234", "to_ids": false, "type": "link", "uuid": "3984bc3f-4c72-4add-8859-f9dc75a4bdf6", "value": "https://bi-zone.medium.com/clubfoot-wolf-launches-massive-offensive-on-russian-businesses-5c2743ff2ebd" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783681234", "to_ids": false, "type": "text", "uuid": "566e6bc3-bc4e-45bd-8c90-88d1d010a3a6", "value": "In May and June 2026, the Clubfoot Wolf cluster executed a large-scale phishing campaign targeting Russian organizations across manufacturing, retail, e-commerce, agriculture, IT, transportation, healthcare, and science sectors, with primary focus on wholesale distributors of chemical products. Several Belarusian organizations were also compromised. The adversary sent phishing emails disguised as invoices or purchase requests, containing ZIP archives with decoy documents and malicious LNK files. Upon execution, a PowerShell script downloaded and installed NetSupport Manager, a legitimate remote administration tool, which was then used for malicious activities. The attackers employed URL shorteners to hide infrastructure and used multiple decoy files to build victim trust. The campaign demonstrated continuous evolution in delivery methods and infection chains." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783681234", "to_ids": false, "type": "text", "uuid": "285e6aa1-25cf-438a-9a6e-59312b09da42", "value": "Name: Massive offensive launched on Russian businesses\nAuthor: AlienVault\nAdversary: Clubfoot Wolf\nTags: [\"lnk file\", \"chemical industry\", \"powershell loader\", \"netsupport manager\", \"belarus\", \"phishing campaign\", \"russian targets\", \"url shortener\"]\nTgtd countries: [\"Belarus\", \"Russian Federation\"]\nMlwr families: [\"NetSupport Manager\"]\nAttack_ids: [\"T1218.011\", \"T1132.001\", \"T1204.002\", \"T1566.001\", \"T1140\", \"T1219\", \"T1055\", \"T1218\", \"T1497.003\", \"T1090.002\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1070.004\", \"T1071.001\", \"T1105\", \"T1564.001\"]\nIndustries: [\"Manufacturing\", \"Retail\", \"Agriculture\", \"Technology\", \"Transportation\", \"Healthcare\", \"Chemical\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783681234", "to_ids": false, "type": "threat-actor", "uuid": "8e586b34-dfb1-4890-87d6-7b5303a21bf6", "value": "Clubfoot Wolf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379484", "to_ids": true, "type": "domain", "uuid": "63220ba5-1ecc-4433-a621-9d5be48a3887", "value": "imhfamily.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379505", "to_ids": true, "type": "domain", "uuid": "ee79259e-a912-409a-b272-a529df5d4acd", "value": "fleepsterones.fun", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379526", "to_ids": true, "type": "url", "uuid": "fd68c55a-b0f4-4d10-bf37-ba2fac3bf551", "value": "https://sunlightfriends.tech/latest/news", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408083", "to_ids": true, "type": "sha256", "uuid": "b433faa8-3cac-4d78-9ddc-bd3dda68b18a", "value": "03dbaee9cbc05abb6a35fd7804dcf7e83e0675da40eabcfd161d1d6b387363b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408085", "to_ids": true, "type": "sha256", "uuid": "dc522ad5-ac74-42dc-96f6-c733da735b67", "value": "100e0ca51a6a25efac16627be80c7ce992a5506470136e43cb8b24d8828ba82b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408087", "to_ids": true, "type": "sha256", "uuid": "e108406c-e059-43fc-8a4a-aaf8591c8812", "value": "3325be6c18c35b66e7f527950af97a4235e04d026a81780c135d6cec3f8245db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408089", "to_ids": true, "type": "sha256", "uuid": "c5dc91c1-4b3c-401d-91d1-0eb4aaf92b41", "value": "6478585efed46b0616ca201c51464de7af5ba8985c3b948f9b67db09cbd62e97", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408091", "to_ids": true, "type": "sha256", "uuid": "07868134-617f-4f3e-8a3f-3c01a7f3493c", "value": "6a8dfd602daa3b9dc2ceb146837a7966a37af8ab224ed11478e1f6d87f375b7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408093", "to_ids": true, "type": "sha256", "uuid": "68df84eb-2024-40c8-bfff-2fcf4c18ac41", "value": "73bd4f12f3e7d155dfbcb6d016b99d40cce8554964ecc51de40b70fab3a4c3a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408094", "to_ids": true, "type": "sha256", "uuid": "a701a27b-4a1f-4f26-8363-3830baf42d72", "value": "7b6f6fe88ff9d953965e81b1bed256528c93ff159156bc17b8811d7cfd5dfe47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408096", "to_ids": true, "type": "sha256", "uuid": "5700b751-68c6-4b67-a3df-252d592019c3", "value": "8fde3f60f9ae901a9fa04888d3050c9a65fb63722a4b41a6d6ad7d38183c37d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408098", "to_ids": true, "type": "sha256", "uuid": "3fec92a6-cee0-47a1-b67d-02ab6794612e", "value": "b38032f5b2059cacc28246dd0b739e19b6a68daf34add740d5ce6be87354b498", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408100", "to_ids": true, "type": "sha256", "uuid": "380c09f0-74cf-4c5f-b386-e87426d82df1", "value": "cdf7c97cfb494ade90886765606294db0b98a2576bc1d152bc8c4ec97672b687", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408103", "to_ids": true, "type": "sha256", "uuid": "e3cac380-d484-40a6-ab2a-b5bb1cf614b9", "value": "d3c90e61c3ffa059658c36e39334cb38c0b23cbde46f5078705fcfad67c9f3d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408105", "to_ids": true, "type": "sha256", "uuid": "dcc5905c-2793-4baf-9545-60fb22ac88bb", "value": "e20c0900513551265dda37ce5334c71f5b0e8b20e19f9d8391f77987e2458f20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408109", "to_ids": true, "type": "sha256", "uuid": "1615a0da-98ee-4c08-bf3a-1ebfa9ece3e9", "value": "f15e4e140fceeb393bcb2c8d61a2333b37c30270527b5c48d8440e3ec1e02ae4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408113", "to_ids": true, "type": "sha256", "uuid": "1fc6c425-ef37-4145-b822-677ff8343105", "value": "fa877d45432e7712d1832508c77f063958a5cec05038152eb2be5e79992c3966", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408117", "to_ids": true, "type": "sha256", "uuid": "a20844a2-449e-45bc-9f06-1aa1a4fc2ebb", "value": "fb25a19a74bc7549f5e4e1f299886fb09a9d5b4fd4599c5a9b7f2d534ce71691", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379547", "to_ids": true, "type": "url", "uuid": "155fc79b-7a14-45e8-89e4-13bfabd35414", "value": "http://akiliridge.com:1414", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379568", "to_ids": true, "type": "url", "uuid": "c4154315-5033-423c-814f-8a7d65340fdd", "value": "http://glowstickspro.com:1411", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379589", "to_ids": true, "type": "url", "uuid": "2cd14281-ad03-4578-b5a5-096ea5fda5e4", "value": "http://imhfamily.com:1414", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379610", "to_ids": true, "type": "url", "uuid": "75468f6e-033d-41e1-ab2c-a4b9598f8fa4", "value": "http://stillpaving.com:1411", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379632", "to_ids": true, "type": "url", "uuid": "1a3667be-5d74-4c12-89fe-bdc7c04748e8", "value": "https://fleepsterones.fun/content/articles", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379653", "to_ids": true, "type": "url", "uuid": "dd466ac8-e4c6-40c0-b329-da42d51f7c87", "value": "https://fleepsterones.fun/fashion/week", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379675", "to_ids": true, "type": "url", "uuid": "51deaee9-b8ca-4f94-b944-69417d84078b", "value": "https://fleepsterones.fun/media/like", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379695", "to_ids": true, "type": "url", "uuid": "ee37d05c-8ab9-461d-aaeb-f4658b68d3e2", "value": "https://sunlightfriends.tech/beauty/series", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379717", "to_ids": true, "type": "url", "uuid": "d8c88a21-4563-4d49-884d-49c8ac01fc8c", "value": "https://sunlightfriends.tech/health/shampoo", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379738", "to_ids": true, "type": "url", "uuid": "c3e8beaf-e65b-46a9-b526-6e25902b8218", "value": "https://sunlightfriends.tech/learning/portal", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379759", "to_ids": true, "type": "url", "uuid": "dc0c4d7e-2384-49a6-9f2c-870adbe244cb", "value": "https://sunlightfriends.tech/monthly/horoscope", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379785", "to_ids": true, "type": "url", "uuid": "6e649664-f721-4b50-b177-b228ca65aaea", "value": "https://sunlightfriends.tech/nature/today", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379806", "to_ids": true, "type": "url", "uuid": "20977c64-896b-4b12-b0a0-1251db5a4774", "value": "https://sunlightfriends.tech/weather/news", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379827", "to_ids": true, "type": "url", "uuid": "38dc15a9-5f2a-4022-8c84-9a6b024dac2c", "value": "https://sunlightfriends.tech/weekly/forecast", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379849", "to_ids": true, "type": "url", "uuid": "a5dbf5c7-90ec-4384-a9d8-b5a87f4c2519", "value": "https://sunlightfriends.tech/world/library", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379870", "to_ids": true, "type": "url", "uuid": "caeeeacb-f99b-4e79-aa2e-982a7a785f91", "value": "https://crop.sh/6zUo8Ok", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379891", "to_ids": true, "type": "url", "uuid": "68d8fa50-b198-4841-9832-ae481ec0cabe", "value": "https://crop.sh/OSRXf5B", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379912", "to_ids": true, "type": "url", "uuid": "c1649123-8700-4810-8586-0b252ab48091", "value": "https://crop.sh/9hXkrRN", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379933", "to_ids": true, "type": "url", "uuid": "6ef312ab-2234-4ab3-85e6-0b7d8b9a874c", "value": "https://crop.sh/r1zUUv4", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379955", "to_ids": true, "type": "url", "uuid": "b0a0fa21-1422-4f0e-9619-c9f239bd5c0c", "value": "https://crop.sh/mD5Gmt2", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379977", "to_ids": true, "type": "url", "uuid": "b8ed2761-ed73-467a-b54d-9c50fe3e32b4", "value": "https://crop.sh/KzcOSm7", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379998", "to_ids": true, "type": "url", "uuid": "9c824210-e953-4e07-8a15-70afd50a6e13", "value": "https://crop.sh/0x47s6B", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380019", "to_ids": true, "type": "url", "uuid": "cf9d8c8d-782a-41b9-9850-dbc08b60c180", "value": "https://crop.sh/72TT8cO", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380041", "to_ids": true, "type": "url", "uuid": "56b42fd4-952d-4831-9c32-f5f64b453b99", "value": "https://crop.sh/enuSDJG", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380063", "to_ids": true, "type": "url", "uuid": "ee400191-8929-4c5c-b852-4b233c4c89f3", "value": "https://crop.sh/OLiH8AD", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380084", "to_ids": true, "type": "url", "uuid": "06b60266-81fe-4c3e-8b39-58ba4f7e69b6", "value": "https://crop.sh/NfhStZD", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380105", "to_ids": true, "type": "url", "uuid": "7334edd3-aa94-4f7f-b356-090fa01f7651", "value": "https://crop.sh/ncPHvl0", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380126", "to_ids": true, "type": "url", "uuid": "bfe21bac-f8fd-493e-998b-7d2419fd5145", "value": "https://disk.yandex.ru/i/6s3ZGTQf7T_P-g", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380147", "to_ids": true, "type": "url", "uuid": "65941935-dd78-4c23-9bbd-d256b4c7596f", "value": "https://disk.yandex.ru/i/RgUWO-uhakJF8w", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784380168", "to_ids": true, "type": "domain", "uuid": "a8f8ec60-f719-4869-8115-d3442eb79cf6", "value": "sunlightfriends.tech", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 1411", "deleted": false, "disable_correlation": false, "timestamp": "1784380190", "to_ids": true, "type": "domain", "uuid": "24b61e33-5bd1-42a7-a78d-ef98bb64aa94", "value": "stillpaving.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 1411", "deleted": false, "disable_correlation": false, "timestamp": "1784380211", "to_ids": true, "type": "domain", "uuid": "1a96cf2d-c883-4fd6-95bc-61e44157e56f", "value": "glowstickspro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 1414", "deleted": false, "disable_correlation": false, "timestamp": "1784380232", "to_ids": true, "type": "domain", "uuid": "2709deeb-b3cd-4109-b887-3bc872b3a621", "value": "akiliridge.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408011", "uuid": "1e1ae135-7b89-4f6d-b4ca-70fbaedf6b40", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "md5", "timestamp": "1784408010", "to_ids": true, "type": "md5", "uuid": "eacc2d82-5b61-44b9-bca9-9544890eccaf", "value": "ce89b9cb3ba97432bc7d06c72e9149b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "sha1", "timestamp": "1784408011", "to_ids": true, "type": "sha1", "uuid": "51663c10-68c4-48ef-a3b3-a8b6327a8014", "value": "54ba6a4ee9d006f60e74c3fc749d6ece9ae7e90d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "sha256", "timestamp": "1784408011", "to_ids": true, "type": "sha256", "uuid": "8a57b285-7898-4df4-86b9-e4e670bc763a", "value": "b24b8d96ebea10cb7e9ffb73256cc46f9041123e7c2cc26fe92d355a8378a87c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "text", "timestamp": "1784367125", "to_ids": false, "type": "text", "uuid": "413f144d-a4d4-426b-8afa-0267e1d2108d", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-05-19T19:11:54+00:00\nLast Submission: 2026-05-19T19:11:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "ssdeep", "timestamp": "1784367125", "to_ids": true, "type": "ssdeep", "uuid": "613d64d7-2edd-4b58-9fa8-223739290e6e", "value": "3072:CZBjCITY0eqizjNpCj4V3yG8SuBqRs47axvjL6jolBC2MTKP:2FY0efpCCiGWo+dL6sjR3P" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367125", "to_ids": false, "type": "size-in-bytes", "uuid": "95995d38-7f3e-4fd0-9b01-2358bbbf37e9", "value": "179400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "vhash", "timestamp": "1784367125", "to_ids": true, "type": "vhash", "uuid": "ad3a2f9a-f42c-4d22-89b7-e864c463c56b", "value": "2046f17e38efc3713fd41870b2cbed85" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T19:11:54+00:00", "last_seen": "2026-05-19T19:11:54+00:00", "object_relation": "filename", "timestamp": "1784367125", "to_ids": true, "type": "filename", "uuid": "8c19194f-8beb-4e13-9bef-3ea4b0fb9cf4", "value": "b24b8d96ebea10cb7e9ffb73256cc46f9041123e7c2cc26fe92d355a8378a87c.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408014", "uuid": "2cdb3900-fc6c-4d31-bfe9-a8399208d738", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "md5", "timestamp": "1784408014", "to_ids": true, "type": "md5", "uuid": "109956af-0c09-47b5-a123-8570f7f7915d", "value": "9cc761eefd1cd30408a4328aec6ea511", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "sha1", "timestamp": "1784408014", "to_ids": true, "type": "sha1", "uuid": "be9d2155-8b0c-480d-baff-9443effa2381", "value": "c65f5d8b9072aefafeee73227610f4082843762a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "sha256", "timestamp": "1784408014", "to_ids": true, "type": "sha256", "uuid": "e32d262d-7477-4e1f-acc2-58a83ffddf06", "value": "490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "text", "timestamp": "1784367146", "to_ids": false, "type": "text", "uuid": "246b55cd-8791-4897-ab66-f576f4cf7f3a", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-05-25T07:11:29+00:00\nLast Submission: 2026-05-25T07:11:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "ssdeep", "timestamp": "1784367146", "to_ids": true, "type": "ssdeep", "uuid": "3e227f39-ea3b-4fe0-82a5-b47235735c41", "value": "3072:p4zaA7QVLvcYS+SbJ121Tz/+JR+M3IAOvwi8fG+KOsWyk5aJEkD7fFzmxE:yp7QVL0Ik7YTzORRskG+KOJykQJ9L4q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367146", "to_ids": false, "type": "size-in-bytes", "uuid": "123e0c19-7aaf-4f38-9158-b804b6a6e953", "value": "148715" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "vhash", "timestamp": "1784367146", "to_ids": true, "type": "vhash", "uuid": "bdaba282-9373-41b7-aee0-d9fe6dd94e1e", "value": "2046f17e38efc3713fd41870b2cbed85" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:29+00:00", "last_seen": "2026-05-25T07:11:29+00:00", "object_relation": "filename", "timestamp": "1784367146", "to_ids": true, "type": "filename", "uuid": "e3883b11-69bb-49d0-8f6a-38a8600f345b", "value": "490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408018", "uuid": "fff44a95-bd33-4797-abbc-9f19e061f6c3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "md5", "timestamp": "1784408017", "to_ids": true, "type": "md5", "uuid": "c16a1479-6225-44be-bc3a-ef255b3dabb6", "value": "1e5c289739f75271e0f5136b93d0dae7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "sha1", "timestamp": "1784408018", "to_ids": true, "type": "sha1", "uuid": "d9c3f132-92b1-465e-8625-1bd2856a3b73", "value": "d1813eb15ed321fc7fa4e1c8c0552a02fc789d69", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "sha256", "timestamp": "1784408018", "to_ids": true, "type": "sha256", "uuid": "64ca155d-9003-4196-b4bc-e24d63275c3e", "value": "31b0f515012355e104a1e4f10baff85c3066a037f17272ce9c2445fd8377a96a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "text", "timestamp": "1784367168", "to_ids": false, "type": "text", "uuid": "45ae15a0-fbf3-4769-82f6-dda0fdd12a0f", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 20/74\nFirst Submission: 2026-05-26T06:25:27+00:00\nLast Submission: 2026-05-26T10:44:01+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "creation-time", "timestamp": "1784367168", "to_ids": false, "type": "datetime", "uuid": "0364b064-51d3-46b4-ac14-8835f59d5dc5", "value": "2026-05-25T19:51:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "ssdeep", "timestamp": "1784367167", "to_ids": true, "type": "ssdeep", "uuid": "ba32f991-91d3-49cb-bce4-f21f88fbbfcd", "value": "24:8f3/Z3fSiirz8jIiDoZhfNOK+AIQjbyRXBIi6KqHHIx:8PFfQojuyA5yDpFqHHk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367167", "to_ids": false, "type": "size-in-bytes", "uuid": "d22b08ea-9ba7-468e-8310-d2085615d212", "value": "1457" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T06:25:27+00:00", "last_seen": "2026-05-26T10:44:01+00:00", "object_relation": "filename", "timestamp": "1784367167", "to_ids": true, "type": "filename", "uuid": "f30b3e7c-1217-48b0-b62f-4ddc2ace3970", "value": "31b0f515012355e104a1e4f10baff85c3066a037f17272ce9c2445fd8377a96a.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408021", "uuid": "4c5c4524-9955-4f3d-91c9-83a3de9ad9a6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "md5", "timestamp": "1784408020", "to_ids": true, "type": "md5", "uuid": "6b19025e-7110-43e8-ac29-e3c37fbcddba", "value": "56cc6b8260c676dca2ee4e4ef4785373", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "sha1", "timestamp": "1784408021", "to_ids": true, "type": "sha1", "uuid": "1078a404-be9e-454b-a149-9255419fa806", "value": "c8d51044d37f247937616adb489836c62b25b599", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "sha256", "timestamp": "1784408021", "to_ids": true, "type": "sha256", "uuid": "a9f569a9-2ba3-4863-a74a-656f2566a7f0", "value": "38d96dd1c26a7a98c8b55c925863d0f5c8c099a73192c65e3a1e47ea636d3d29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "text", "timestamp": "1784367189", "to_ids": false, "type": "text", "uuid": "18abdd14-1097-4df6-965c-aafa1d6dd7a5", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-06-03T06:52:56+00:00\nLast Submission: 2026-06-03T06:52:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "ssdeep", "timestamp": "1784367189", "to_ids": true, "type": "ssdeep", "uuid": "3a59eb80-5f73-49a7-b9fc-c85a863ea76f", "value": "12288:+OO/oQFth4sOge0Qa8zteK1w+1C9xytMGvFRvah4g39wWyt:vQFvvkJztn1w+U9xyLFIh4g39wWc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367189", "to_ids": false, "type": "size-in-bytes", "uuid": "acc830cc-6161-4c0b-bc4b-1794c2401ea9", "value": "627224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "vhash", "timestamp": "1784367189", "to_ids": true, "type": "vhash", "uuid": "651b3fe8-7f93-4946-8aa2-c725cc3639a0", "value": "f58b3914a760b8d10bc7ac54d0a706b8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:52:56+00:00", "last_seen": "2026-06-03T06:52:56+00:00", "object_relation": "filename", "timestamp": "1784367189", "to_ids": true, "type": "filename", "uuid": "338082a3-b079-49f0-8dd2-dee740b7c841", "value": "38d96dd1c26a7a98c8b55c925863d0f5c8c099a73192c65e3a1e47ea636d3d29.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408024", "uuid": "2482becd-8884-4871-a5da-b31888170f7e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "md5", "timestamp": "1784408023", "to_ids": true, "type": "md5", "uuid": "db7dd813-ef7c-4ee5-8f24-15df9c598181", "value": "5c56fd9d306a62642cfe6c6b3989efdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "sha1", "timestamp": "1784408024", "to_ids": true, "type": "sha1", "uuid": "68f8328b-8890-4780-ac52-e0e4c80459a4", "value": "fbdb66de614bd41a1d68f3fa0abc85fb092b28bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "sha256", "timestamp": "1784408024", "to_ids": true, "type": "sha256", "uuid": "75fbb9fc-846b-4f3d-8e19-b468ccc0932e", "value": "c5a1dee1ae7f0a04dfa91481d0c1d5ad5c887a77e657def8878af600a98fd8c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "text", "timestamp": "1784367210", "to_ids": false, "type": "text", "uuid": "fd1f8887-e782-449c-9dc9-fe8dec8112b0", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-06-03T06:53:18+00:00\nLast Submission: 2026-06-03T06:53:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "creation-time", "timestamp": "1784367210", "to_ids": false, "type": "datetime", "uuid": "9e33a22d-e199-463c-991d-1afc2ea25bc3", "value": "2026-06-03T05:09:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "ssdeep", "timestamp": "1784367210", "to_ids": true, "type": "ssdeep", "uuid": "23597ea6-245c-4a71-b718-9b2b26535698", "value": "24:8+lPW6lfylagP8i7zqFFmKxqxG52/Qpx6tJJpLjbyRFTktzroilo1h4x:8+lO6lfGfPpcmDJ/Qb6tb9yjTk592hU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367210", "to_ids": false, "type": "size-in-bytes", "uuid": "40c79e8e-9aa8-4775-93b9-327739b96d38", "value": "1477" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:53:18+00:00", "last_seen": "2026-06-03T06:53:18+00:00", "object_relation": "filename", "timestamp": "1784367210", "to_ids": true, "type": "filename", "uuid": "b6e4ea4d-9325-4645-ab37-3396599a0838", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u041e\u041e \u0422\u0435\u0445\u041f\u0440\u043e\u043c\u0421\u0435\u0440\u0442 \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408027", "uuid": "dff0984b-5dee-42ac-96b7-67eb2da48e3c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "md5", "timestamp": "1784408026", "to_ids": true, "type": "md5", "uuid": "cad0e33f-3c8a-4bbd-b8ad-11189b39d1bb", "value": "909194b6162b9c1c4e4e88dc1e8d4c9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "sha1", "timestamp": "1784408026", "to_ids": true, "type": "sha1", "uuid": "37e4cd9a-d6b6-4061-970a-860f5ab4790e", "value": "6a495bafab006d577bebd4ef1ec026cda1d360b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "sha256", "timestamp": "1784408027", "to_ids": true, "type": "sha256", "uuid": "7b7e977f-a468-4ebb-8cd3-ffc4008b8f53", "value": "cee0ad69647d4840013e836b657d8fd79b9be7389ccbc70e15c5cb96bf926f8a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "text", "timestamp": "1784367232", "to_ids": false, "type": "text", "uuid": "ade712b0-84a1-473c-87dd-6533d74ad3b4", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-05-19T19:12:52+00:00\nLast Submission: 2026-05-20T11:41:58+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "creation-time", "timestamp": "1784367232", "to_ids": false, "type": "datetime", "uuid": "824f2671-42bb-4006-aff4-a942e850fea7", "value": "2026-05-19T05:21:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "ssdeep", "timestamp": "1784367232", "to_ids": true, "type": "ssdeep", "uuid": "6116cd15-cd0a-44e5-93e3-9f4ffff2837a", "value": "24:83daaYkCngengekfxngCnJignUzUYpHclEoZhfNOK+jIodqZM8eu1LCoiOux:83Skxekf07myj5x8euB2j" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367232", "to_ids": false, "type": "size-in-bytes", "uuid": "d31828c8-0e2f-43a6-bea7-b891df3d0279", "value": "1345" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T19:12:52+00:00", "last_seen": "2026-05-20T11:41:58+00:00", "object_relation": "filename", "timestamp": "1784367232", "to_ids": true, "type": "filename", "uuid": "6bc85dc8-9c2d-4663-8416-55aaaefa46a0", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u042e\u043d\u0438\u043b\u0430\u0431 \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408029", "uuid": "46a63138-53d8-498f-8758-9f7d127f044e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "md5", "timestamp": "1784408029", "to_ids": true, "type": "md5", "uuid": "395ae7bf-6d21-4a86-9bb5-154c20ad2092", "value": "c9386d789015d30f85546d04c1331f60", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "sha1", "timestamp": "1784408029", "to_ids": true, "type": "sha1", "uuid": "d0d7b317-a556-468f-bc3f-1c452e98a6d8", "value": "ba33bbe881c02e628ea8f2751749ee9afb4c2441", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "sha256", "timestamp": "1784408029", "to_ids": true, "type": "sha256", "uuid": "1763a72e-4930-4c6f-858f-551fe8f77332", "value": "bea07bc2359e8f3ce914b0027b5548ae58c9a019f330446b2c81050cd9ca1b0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "text", "timestamp": "1784367253", "to_ids": false, "type": "text", "uuid": "241d4f39-30e6-4262-9158-b4b078e26ef2", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 19/74\nFirst Submission: 2026-05-25T07:11:50+00:00\nLast Submission: 2026-05-25T07:11:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "creation-time", "timestamp": "1784367253", "to_ids": false, "type": "datetime", "uuid": "24363a31-3aba-44b0-9f4c-4f17c46b8e7d", "value": "2026-05-24T18:50:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "ssdeep", "timestamp": "1784367253", "to_ids": true, "type": "ssdeep", "uuid": "f3661146-9ddd-4f71-bbdc-d7d67603dcdd", "value": "24:8xjtfGmiXzUYxT1aEoZhfNOK+KrjbySa+OPidRx:8xhfE73uyAySgPm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367253", "to_ids": false, "type": "size-in-bytes", "uuid": "87fe8831-468d-44ec-a72a-c899f65a12fd", "value": "1381" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "filename", "timestamp": "1784367253", "to_ids": true, "type": "filename", "uuid": "9c98adff-9b6e-4926-9aac-0b0440d58db6", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u041e\u041e \u0411\u043e\u0440\u043e\u0432\u043a\u043e\u0432\u043e \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408032", "uuid": "e0792cce-e6f1-4312-85af-98ff56ebce42", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "md5", "timestamp": "1784408032", "to_ids": true, "type": "md5", "uuid": "e8c26b09-f48a-495d-a251-d4b7f7ed2429", "value": "ddc68b4d2612db3c44f3590ee3603eb6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "sha1", "timestamp": "1784408032", "to_ids": true, "type": "sha1", "uuid": "6fd86e0f-7dfc-4d2e-a4c6-aacc7b73ac85", "value": "82c03c4ee142e862da2e736c691caa65fecc2acb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "sha256", "timestamp": "1784408032", "to_ids": true, "type": "sha256", "uuid": "de721d0f-5fd8-4dd3-9cd7-82608c89a29e", "value": "bed54c819cc8ff502fff41f6d9c726836b6086c9afdd47f2261809196c973c38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "text", "timestamp": "1784367274", "to_ids": false, "type": "text", "uuid": "a09e021a-ef7f-45fd-8866-693356688347", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2024-06-27T07:20:33+00:00\nLast Submission: 2026-05-23T22:18:44+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "creation-time", "timestamp": "1784367275", "to_ids": false, "type": "datetime", "uuid": "a2e58a79-c30c-4482-a3ce-3d1f9351ee2c", "value": "2021-09-21T08:27:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "ssdeep", "timestamp": "1784367274", "to_ids": true, "type": "ssdeep", "uuid": "3b066125-78d6-4f9c-8f3a-9a5581b06c29", "value": "3072:0l3DKh1eGnoFOBqF/slmyT3sK/wot9Ff+ESZV3rfdRLLFbdU8Hc0eRsdvKCp+WJe:KzKhtEF/sl1Dltt3vIbDpbtekKmykh1S" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367274", "to_ids": false, "type": "size-in-bytes", "uuid": "e1ec4f3e-4093-4e78-bb20-04d0e1febf82", "value": "188920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "vhash", "timestamp": "1784367274", "to_ids": true, "type": "vhash", "uuid": "06a864b6-9a7e-4d9c-9279-3a6b84506956", "value": "9bd3a401a52d8ae06b2c54d8123c648e4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-27T07:20:33+00:00", "last_seen": "2026-05-23T22:18:44+00:00", "object_relation": "filename", "timestamp": "1784367274", "to_ids": true, "type": "filename", "uuid": "19156161-fe4f-40ca-8c13-bead6a82963f", "value": "\u0432\u044b\u043f\u0438\u0441\u043a\u0430 \u0415\u0413\u0420\u042e\u041b \u042e\u043d\u0438\u043b\u0430\u0431-\u0418\u0440\u043a\u0443\u0442\u0441\u043a 21.09.21.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408035", "uuid": "122801dc-a4d8-4963-9a3f-b83f874d307c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "md5", "timestamp": "1784408034", "to_ids": true, "type": "md5", "uuid": "6a66aaa3-a4de-4c2b-a4e1-9d08dcd76da3", "value": "fc00460dda7b44a1fea71cf24f4cfa6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "sha1", "timestamp": "1784408035", "to_ids": true, "type": "sha1", "uuid": "5b6181d3-5a02-49f3-8b37-5e8ba44b602a", "value": "44785a4297a233cf36adbe1ac7cb0523372d1338", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "sha256", "timestamp": "1784408035", "to_ids": true, "type": "sha256", "uuid": "92f524c6-2229-4e33-a7c5-d948fee787fe", "value": "9fa461bd75788d27ceb778dc0f9773d641e804b3e10103c482ba4747153178f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "text", "timestamp": "1784367296", "to_ids": false, "type": "text", "uuid": "1941ed57-308a-4cda-b39e-ce5dd7b2b8d0", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-25T07:11:50+00:00\nLast Submission: 2026-05-26T19:00:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "creation-time", "timestamp": "1784367296", "to_ids": false, "type": "datetime", "uuid": "273e2a08-4058-4335-9589-8cf677b8bd69", "value": "2018-11-12T10:28:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "ssdeep", "timestamp": "1784367296", "to_ids": true, "type": "ssdeep", "uuid": "768aedaa-0c57-4c8e-aaae-2130d527d2f3", "value": "3072:l0vj9t3LdmS1YRjWAabzpF1wOvwi8+ylfGRgMkhJbVHG5+WBo:aFLTbVws9AfG7kh1VHs+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367296", "to_ids": false, "type": "size-in-bytes", "uuid": "3854ad75-d46c-4a2a-873c-6e4bac01fded", "value": "149605" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "vhash", "timestamp": "1784367296", "to_ids": true, "type": "vhash", "uuid": "da44c3af-1c6a-4a02-80e8-98a9f70d50ee", "value": "9cf7f0bad2bd64b748adf725d5380155a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-26T19:00:18+00:00", "object_relation": "filename", "timestamp": "1784367296", "to_ids": true, "type": "filename", "uuid": "43d2ce1d-2f93-4526-8e01-fafa07fc9a6a", "value": "\u0412\u044b\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0415\u0413\u0420\u042e\u041b.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408038", "uuid": "d91008c0-bf7e-4a57-b14f-88d10dd39663", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "md5", "timestamp": "1784408037", "to_ids": true, "type": "md5", "uuid": "5f0c5c79-7d37-4490-a6cd-30fc41106eb6", "value": "da95797a9bcfe8ee9500077636f0835a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "sha1", "timestamp": "1784408037", "to_ids": true, "type": "sha1", "uuid": "674e248f-32c6-480a-b6ba-364891161e8a", "value": "2e7b753186817a85961cdefb47bdf5436515b694", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "sha256", "timestamp": "1784408038", "to_ids": true, "type": "sha256", "uuid": "a7dc3d39-9b30-4d1c-80c3-16105768ab78", "value": "0c2947904711ef63ac3cc24ba2e7a059e318dc219d14eeaebb6b46fd277f7f3d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "text", "timestamp": "1784367339", "to_ids": false, "type": "text", "uuid": "ebe3a73e-04bb-4ce6-8ff4-72c1dcdebee0", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-05-28T09:55:45+00:00\nLast Submission: 2026-05-28T09:55:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "ssdeep", "timestamp": "1784367339", "to_ids": true, "type": "ssdeep", "uuid": "7cf7b813-9da6-43fb-a6ee-bc483c9d93a3", "value": "12288:Y+vU4Gl80tG3uG4cSkP0vACr6zLsJqLV1:84GVtGHivA+6zLs61" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367339", "to_ids": false, "type": "size-in-bytes", "uuid": "7e709fae-1f97-48b6-8649-19da57c2d48b", "value": "429825" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:55:45+00:00", "last_seen": "2026-05-28T09:55:45+00:00", "object_relation": "vhash", "timestamp": "1784367339", "to_ids": true, "type": "vhash", "uuid": "5e7613b6-dc9b-4b7a-88e0-34c99951c3b8", "value": "73ed0b2c1e2c363cac582cc0655e8af0" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408041", "uuid": "3b1ce2ea-a655-4a94-9e11-e5bdace27705", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "md5", "timestamp": "1784408040", "to_ids": true, "type": "md5", "uuid": "e8daaa95-1880-49d7-85b5-7fe77afdad4e", "value": "c91a5f94b1c83d4e00e676e590a404b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "sha1", "timestamp": "1784408040", "to_ids": true, "type": "sha1", "uuid": "43db2c41-9532-4323-b619-a084a98678bc", "value": "1b8c444f18554b26578988a87cd42a009645a561", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "sha256", "timestamp": "1784408041", "to_ids": true, "type": "sha256", "uuid": "f8e28ac9-be36-4263-98c9-0477f17ef2c4", "value": "11ad9f6c235ea561317d89590fa41d75348019850735b998b60661635ad99e9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "text", "timestamp": "1784367381", "to_ids": false, "type": "text", "uuid": "a4ef1b98-15a7-48b9-8407-c6399b5839f3", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-06-15T08:28:42+00:00\nLast Submission: 2026-06-15T08:28:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "ssdeep", "timestamp": "1784367381", "to_ids": true, "type": "ssdeep", "uuid": "4189286c-b6be-47c3-9b9b-c989ec5771ea", "value": "24576:LdlV1HaNNJNOWdB8w9dtJAqON3DVZHcwn5rrzTgsEteeaBbc740R:LdF6d42BDjA7N3D8wn5XzssE0deE0R" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367381", "to_ids": false, "type": "size-in-bytes", "uuid": "bc88d7ea-3068-4665-96ac-a5c39fe26cda", "value": "1118216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:28:42+00:00", "last_seen": "2026-06-15T08:28:42+00:00", "object_relation": "vhash", "timestamp": "1784367381", "to_ids": true, "type": "vhash", "uuid": "fb31eae8-0ea1-418d-af68-22b7a8c37281", "value": "a1676f208ac918d0b9193f01fff4c08c" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408044", "uuid": "710e32cb-35eb-4784-bf57-b7f14ee4d9a1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "md5", "timestamp": "1784408043", "to_ids": true, "type": "md5", "uuid": "68762148-126f-43b6-ba30-bd1e49d18866", "value": "174a44b2a1511e7ebf64525beffd0f9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "sha1", "timestamp": "1784408044", "to_ids": true, "type": "sha1", "uuid": "11a41676-ddfd-45e3-bacb-0bcd1c0c0f0d", "value": "0c964a304edaa8d5d5c58486f4fea4bebe4de36b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "sha256", "timestamp": "1784408044", "to_ids": true, "type": "sha256", "uuid": "4e3b71f1-839c-4861-b7d2-d5c20d41c048", "value": "20c8fd700796b80ea093e23ec812943adfc63c3b8653bb09b581fd7f4127c652", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "text", "timestamp": "1784367402", "to_ids": false, "type": "text", "uuid": "d616cc03-fbb5-401b-ac7b-a07a8c492dbc", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-05-28T09:56:20+00:00\nLast Submission: 2026-05-28T09:56:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "creation-time", "timestamp": "1784367402", "to_ids": false, "type": "datetime", "uuid": "cabe38cd-0e55-4c43-b4b9-a91bfef6e3b9", "value": "2026-05-28T04:34:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "ssdeep", "timestamp": "1784367402", "to_ids": true, "type": "ssdeep", "uuid": "337ef67e-1977-43ee-b204-07eea44290bf", "value": "24:8j83kfckfCiirgI9BqxG52/Qpx6tlktVfmQ6E8Y4dqZM8eutqTkmtOolmj1h4x:8j805f4pCJ/Qb6tlMfAdfx8euYTkzthU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367402", "to_ids": false, "type": "size-in-bytes", "uuid": "ea543edc-35c3-46cb-a133-d6810215978a", "value": "1490" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "filename", "timestamp": "1784367402", "to_ids": true, "type": "filename", "uuid": "4db9d806-ded5-45f6-899d-92e248bfbcc8", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u041e\u041e \u0411\u0435\u043b\u041a\u043e\u043c\u0438\u043d-\u0420\u0423\u0421 \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408047", "uuid": "657c0486-9fb1-4847-a66f-8965426a598f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "md5", "timestamp": "1784408046", "to_ids": true, "type": "md5", "uuid": "45b9d6a1-e496-46e9-98c5-0cec7ede2365", "value": "f5c69b61054ee175a85226a79006c51e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "sha1", "timestamp": "1784408046", "to_ids": true, "type": "sha1", "uuid": "be506c66-f6ce-482e-9ebc-9c6798a3aa28", "value": "6700b7c4060fbdf32f9ef0b2a27405f0350742af", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "sha256", "timestamp": "1784408047", "to_ids": true, "type": "sha256", "uuid": "8c34e586-a93b-4e20-a01e-f64152b0cee9", "value": "41c1b4b09cb3185075f57befd5278119ee0a952418144779898378f0963897e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "text", "timestamp": "1784367444", "to_ids": false, "type": "text", "uuid": "15bb9a5b-cda1-4663-9d8b-5a58e4af5443", "value": "Type Description: MS Word Document\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-27T08:27:20+00:00\nLast Submission: 2026-05-27T08:27:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "creation-time", "timestamp": "1784367445", "to_ids": false, "type": "datetime", "uuid": "87d9eb52-9aa9-492c-b34c-c6252855e7c2", "value": "2021-11-24T09:36:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "ssdeep", "timestamp": "1784367444", "to_ids": true, "type": "ssdeep", "uuid": "0e177800-362e-45b4-ba21-0a7fc998a92e", "value": "1536:kYlObk5iPV2N2PTmklOEDSJAju1hAN3h33vEqHBpDRhem2+MVrs:KCANRcqHLtheg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367444", "to_ids": false, "type": "size-in-bytes", "uuid": "3c271a05-55e6-4740-9318-dd66f3c9764d", "value": "66048" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "vhash", "timestamp": "1784367444", "to_ids": true, "type": "vhash", "uuid": "6edd7879-d984-429a-93b6-877b16e5f47f", "value": "02ff26b696fdeecad4120b26c05782e4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "filename", "timestamp": "1784367444", "to_ids": true, "type": "filename", "uuid": "19fa0c08-dcd6-459d-8827-0465f171b348", "value": "\u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430_\u041e\u041e\u041e_\u0422\u041f\u041f_\u042d\u043d\u0435\u0440\u0433\u043e\u041c\u043e\u0434\u0443\u043b\u044c_\u041d\u041e\u0412\u0410\u042f.doc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408049", "uuid": "15442b53-0877-428a-a799-45010d27dfa0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "md5", "timestamp": "1784408049", "to_ids": true, "type": "md5", "uuid": "1b01f281-c97b-44d8-9f02-1b2c540d3c45", "value": "3c74d2ff9b610be84183587d7a4ff6ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "sha1", "timestamp": "1784408049", "to_ids": true, "type": "sha1", "uuid": "99798c14-eeaf-45bb-8359-e9dc53e1d13d", "value": "8adba8b1fa13b32028df10839ad067bc7ea4fded", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "sha256", "timestamp": "1784408049", "to_ids": true, "type": "sha256", "uuid": "0cbec69c-2d27-45c6-b22e-8c2e54cf050c", "value": "45154678b808a70316f0172a5012ffdfc7d7ddcde856440099fcdbad64e84ddb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "text", "timestamp": "1784367466", "to_ids": false, "type": "text", "uuid": "37ffca87-996b-4354-9ca0-06c53589423d", "value": "Type Description: MS Word Document\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-25T07:11:50+00:00\nLast Submission: 2026-05-25T07:11:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "creation-time", "timestamp": "1784367466", "to_ids": false, "type": "datetime", "uuid": "cd6268d7-c8e9-4cd9-9559-ac6a66f8a4fd", "value": "2016-03-14T04:12:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "ssdeep", "timestamp": "1784367466", "to_ids": true, "type": "ssdeep", "uuid": "7bf2bc10-52a4-4bfc-98a3-e30f071aeef6", "value": "384:BJFdCAP/WXhS0EX+8eyGcSdW+wRsCBecTYO:/FsAXWXhS0EXLKCBxYO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367466", "to_ids": false, "type": "size-in-bytes", "uuid": "cbec4be5-cf88-4c0b-b0e0-74905f53515c", "value": "34304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "vhash", "timestamp": "1784367466", "to_ids": true, "type": "vhash", "uuid": "cb579cd6-29ee-4d43-bdb5-b7b52a24da90", "value": "5a273c04001d9f79e8dd525183a59208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T07:11:50+00:00", "last_seen": "2026-05-25T07:11:50+00:00", "object_relation": "filename", "timestamp": "1784367466", "to_ids": true, "type": "filename", "uuid": "ad931225-99e6-4cf2-acbb-7ed3abcb5d5f", "value": "\u0420\u0435\u043a\u0432\u0438\u0437\u0438\u0442\u044b \u041e\u041e\u041e \u0411\u043e\u0440\u043e\u0432\u043a\u043e\u0432\u043e (\u041d\u041e\u0412\u042b\u0415).doc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408052", "uuid": "3d7e27d8-a5bd-4dee-a1ea-693b610070b6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "md5", "timestamp": "1784408051", "to_ids": true, "type": "md5", "uuid": "0bdb9d7d-fd3d-4b97-ab24-fab8ff0ccc5d", "value": "04a99c1cdcc0c9aa0c63c20d89f9b00f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "sha1", "timestamp": "1784408052", "to_ids": true, "type": "sha1", "uuid": "b0ef5b04-b17f-4e04-9b2e-5771086c72cb", "value": "bed70a8b4b8ee1a45f54d6b62efe387cd6812b54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "sha256", "timestamp": "1784408052", "to_ids": true, "type": "sha256", "uuid": "eef8d440-28d2-42bc-b062-d90c168250c1", "value": "4972b6583645d28600f076e73def05890b54a9d98c8b328d61f421c79a021db6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "text", "timestamp": "1784367488", "to_ids": false, "type": "text", "uuid": "620bec50-3fe6-4d45-adfb-59a4ca6d6b6b", "value": "Type Description: Office Open XML Document\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-06-03T06:53:17+00:00\nLast Submission: 2026-06-03T06:53:17+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "creation-time", "timestamp": "1784367488", "to_ids": false, "type": "datetime", "uuid": "1a64d2e9-879f-4fa8-998f-5287d4d6467a", "value": "2018-12-06T08:30:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "ssdeep", "timestamp": "1784367488", "to_ids": true, "type": "ssdeep", "uuid": "5051ca24-14f8-4210-8f0f-9a9bf012f39f", "value": "384:TKcUHe2SxW+wRsCEfBX5inLMU3LUSHRg4Uekxz:Tr6SaKCEJJinLjxa1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367488", "to_ids": false, "type": "size-in-bytes", "uuid": "5138f2a0-7854-4a9d-883d-e1513960605f", "value": "15641" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "vhash", "timestamp": "1784367488", "to_ids": true, "type": "vhash", "uuid": "5da99c0f-ca5f-4e6f-877a-4227f1337060", "value": "fd0c9174fc6b429061c7cc8d03c22393" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T06:53:17+00:00", "last_seen": "2026-06-03T06:53:17+00:00", "object_relation": "filename", "timestamp": "1784367488", "to_ids": true, "type": "filename", "uuid": "794bf151-9143-42af-861f-428ca39d77a7", "value": "\u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430_\u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f.docx" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408055", "uuid": "fb317dcc-9953-43ad-bb16-2b9c981ae83c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "md5", "timestamp": "1784408054", "to_ids": true, "type": "md5", "uuid": "cb250421-c845-4dfc-80ef-1a2507a4107b", "value": "4b678f02ec161485cb159d6e33333f8a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "sha1", "timestamp": "1784408054", "to_ids": true, "type": "sha1", "uuid": "80e56bc4-daeb-4890-bc75-f9d9b0bd881f", "value": "46e1a825a4546ef6c6b2586f1bede2c9be0c53c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "sha256", "timestamp": "1784408055", "to_ids": true, "type": "sha256", "uuid": "bc90e89f-8050-4d47-8cfe-2ba762ed91e8", "value": "53c6a0a51ef3cf9d38034a7600c94e1ae3968dbec5bbb5d9fdcd26764c6b30e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "text", "timestamp": "1784367510", "to_ids": false, "type": "text", "uuid": "c3a6cd5f-d5c3-42d8-a01f-c78e8754be1a", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-28T09:56:20+00:00\nLast Submission: 2026-05-28T09:56:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "creation-time", "timestamp": "1784367510", "to_ids": false, "type": "datetime", "uuid": "96f0e9a8-e427-45a2-b2ad-75e7c48cef21", "value": "2018-02-08T10:09:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "ssdeep", "timestamp": "1784367510", "to_ids": true, "type": "ssdeep", "uuid": "f5c1d88f-6638-43b5-89ec-9b6ec423115a", "value": "6144:AVjMJuaLXEQqU3MGbnqueeQ2te8+XO//7RiIploYKwqrgONvFQTE:AVjMJXUQqUcGUeQv8Au/7RzpOHwevqE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367510", "to_ids": false, "type": "size-in-bytes", "uuid": "7ded26b0-297b-4d51-b7bb-9859e1cddce7", "value": "336489" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "vhash", "timestamp": "1784367510", "to_ids": true, "type": "vhash", "uuid": "cdd8ab31-84a5-4dea-ba4e-80bb0e35d1e2", "value": "961571fbcd936513bb8b3a2e57f90012b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "filename", "timestamp": "1784367510", "to_ids": true, "type": "filename", "uuid": "dad7184f-aa2b-4860-8962-cab58c7c2de9", "value": "\u0410\u043d\u043a\u0435\u0442\u0430 \u0411\u0435\u043b\u041a\u043e\u043c\u0438\u043d-\u0420\u0423\u0421 \u0410\u043b\u044c\u0444\u0430 \u0411\u0430\u043d\u043a .pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408057", "uuid": "2ef0d70b-20da-4d55-a281-55524b3ed907", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "md5", "timestamp": "1784408057", "to_ids": true, "type": "md5", "uuid": "e2a89c95-dca1-41a0-ba24-4ad3ba1cfcd3", "value": "6663f672fefa416ed706d8a1afd0dc99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "sha1", "timestamp": "1784408057", "to_ids": true, "type": "sha1", "uuid": "e6745401-85f5-41a8-9f7b-175998f4f8d1", "value": "d8de7e188274a4d1280a78765e3f395e38d8de6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "sha256", "timestamp": "1784408057", "to_ids": true, "type": "sha256", "uuid": "d895ce63-107a-4b9e-a86f-fe29d6871584", "value": "644ad315071324e7f86e9b04dfc7dae515ca1a7ae386b21207c4ab38d1a164d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "text", "timestamp": "1784367531", "to_ids": false, "type": "text", "uuid": "326712a1-acfc-4a48-bb96-0886c17fb98e", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-28T09:56:20+00:00\nLast Submission: 2026-05-28T09:56:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "ssdeep", "timestamp": "1784367531", "to_ids": true, "type": "ssdeep", "uuid": "0a4251ed-3622-4f0e-87b6-7570f4383fc1", "value": "3072:LBv5C7IdMvKqgB/CrGczdSXVHYEat8c0/iuV:LBhCUMvKqgB/CrtxSXlYEw8r/iuV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367531", "to_ids": false, "type": "size-in-bytes", "uuid": "6468d32d-7750-46f8-ae1a-3b37e39e013e", "value": "167799" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "vhash", "timestamp": "1784367531", "to_ids": true, "type": "vhash", "uuid": "0451c177-f1a5-49fd-94cc-c1f76f7f06de", "value": "9e9effedb59266650389dc3704586b3b2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T09:56:20+00:00", "last_seen": "2026-05-28T09:56:20+00:00", "object_relation": "filename", "timestamp": "1784367531", "to_ids": true, "type": "filename", "uuid": "81bea21a-9181-4eb6-be4d-b6e2b991394f", "value": "\u0421\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u043e \u043f\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432 \u043d\u0430\u043b\u043e\u0433\u043e\u0432\u0443\u044e.\u0411\u041a.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408060", "uuid": "6bc066fd-2e28-43a7-9078-04d21490d90c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "md5", "timestamp": "1784408059", "to_ids": true, "type": "md5", "uuid": "22ef336a-cfc1-4bd5-8855-c1edbcdbcd8f", "value": "127ce2d154a187ac9cbeeecd03911926", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "sha1", "timestamp": "1784408060", "to_ids": true, "type": "sha1", "uuid": "bdee860e-90bf-4e82-8c37-37d9c85ed717", "value": "34807f3fb8e19fa309304ba586b8a8955386e7db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "sha256", "timestamp": "1784408060", "to_ids": true, "type": "sha256", "uuid": "bd620771-3f90-4954-8d93-042840b8b7be", "value": "79f169be997f883ef02559a0af3f014f63c1c0308931913decd79c0aafaf659f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "text", "timestamp": "1784367615", "to_ids": false, "type": "text", "uuid": "cc138fd9-4e78-4836-b1c7-55027a81fa98", "value": "Type Description: MS Word Document\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2024-06-27T07:15:57+00:00\nLast Submission: 2026-05-23T22:18:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "creation-time", "timestamp": "1784367615", "to_ids": false, "type": "datetime", "uuid": "83beee8c-a8e1-43d7-8c81-19c3179e79d1", "value": "2018-06-28T05:43:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "ssdeep", "timestamp": "1784367615", "to_ids": true, "type": "ssdeep", "uuid": "a272975b-6736-4f12-ae37-41e1b6d01500", "value": "96:rZ8uUPf1A5CAcYNpwYnnUQ12e6NgzMzp0SnSeP16HbmqvU1c7D6kxNPyTHQhABJh:rZILYNjnT1sp0Qr8vOTHbBJfdA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367615", "to_ids": false, "type": "size-in-bytes", "uuid": "85693ad4-983f-41e2-9881-4cbcef6d1528", "value": "22016" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "vhash", "timestamp": "1784367615", "to_ids": true, "type": "vhash", "uuid": "cac3ea53-ccfe-4a46-b868-ffb9d0a2f1f8", "value": "a927028c50ecde55ff589d8e92723ab9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-06-27T07:15:57+00:00", "last_seen": "2026-05-23T22:18:42+00:00", "object_relation": "filename", "timestamp": "1784367615", "to_ids": true, "type": "filename", "uuid": "0595a810-541b-47e6-8fb9-b986279cd710", "value": "\u041c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u041e\u041e\u041e \u042e\u041d\u0418\u041b\u0410\u0411-\u0418\u0440\u043a\u0443\u0442\u0441\u043a (\u0422\u0438\u043d\u044c\u043a\u043e\u0444\u0444).doc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408062", "uuid": "13702074-60a4-4edd-9dd4-ce47a98a7761", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "md5", "timestamp": "1784408062", "to_ids": true, "type": "md5", "uuid": "d627717d-4f9b-4993-abc6-b32498f08c6c", "value": "98bbc408f545c4c0ee59a220209028c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "sha1", "timestamp": "1784408062", "to_ids": true, "type": "sha1", "uuid": "0f941e9c-8933-4e2c-99fe-3db55acd0254", "value": "1bd08566984d9f254df3948a938784f07fccf2c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "sha256", "timestamp": "1784408062", "to_ids": true, "type": "sha256", "uuid": "76ed0ada-eee3-4807-8101-3997178546b4", "value": "7f58b98e9d4b2d06dadef2b8656d337283118a135806dd711fb9de51ca63911d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "text", "timestamp": "1784367660", "to_ids": false, "type": "text", "uuid": "91c39c5f-09fa-4389-ab50-35a02de0e58d", "value": "Type Description: MS Word Document\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2023-07-26T10:04:26+00:00\nLast Submission: 2023-07-26T10:04:26+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "creation-time", "timestamp": "1784367660", "to_ids": false, "type": "datetime", "uuid": "d9c7a434-2326-41c6-bb84-6e564aae8296", "value": "2013-02-13T11:49:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "ssdeep", "timestamp": "1784367660", "to_ids": true, "type": "ssdeep", "uuid": "0d1d88b9-a81b-4ec8-b3c5-d5436189bb23", "value": "384:Mk8fpPsOyk/frfShnuaygViJuUgoktmoAZyGcSdW+wRsCBHgRJht:MKnhVKCBHGJr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367660", "to_ids": false, "type": "size-in-bytes", "uuid": "948ac934-e960-41cc-b46d-d2574774ff44", "value": "41984" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "vhash", "timestamp": "1784367660", "to_ids": true, "type": "vhash", "uuid": "aba5bd49-b079-4b90-ab9b-8e4fba22b57d", "value": "d1480e2fbeee9122df830395f3fe344e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-07-26T10:04:26+00:00", "last_seen": "2023-07-26T10:04:26+00:00", "object_relation": "filename", "timestamp": "1784367660", "to_ids": true, "type": "filename", "uuid": "1091c6a0-f996-48b2-8d31-15698f5cc596", "value": "\u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u041e\u041e\u041e \u041f\u0440\u043e\u043c\u041c\u0435\u0442\u0420\u0435\u0441\u0443\u0440\u0441.doc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408065", "uuid": "48195d89-0103-477b-8880-0450da436d98", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "md5", "timestamp": "1784408064", "to_ids": true, "type": "md5", "uuid": "69b553f5-6ffc-43a7-8457-717da831fa88", "value": "423fe00fb8beb66f9f91d93e311863c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "sha1", "timestamp": "1784408065", "to_ids": true, "type": "sha1", "uuid": "014db015-cc41-469d-9969-5816aa466a87", "value": "3dedb8ea9e0557b22b4e2f2b87ad8fd60c38475c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "sha256", "timestamp": "1784408065", "to_ids": true, "type": "sha256", "uuid": "1287d45b-9250-4a4a-8737-b5d67ceed23a", "value": "82671b7f09811ff38b3cab186776d06cc9e89d434080f1eb26fa1c35767eaca5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "text", "timestamp": "1784367682", "to_ids": false, "type": "text", "uuid": "8158bae3-7f1f-4359-8412-e32df40a6103", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-06-15T08:29:24+00:00\nLast Submission: 2026-06-15T08:29:24+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "creation-time", "timestamp": "1784367682", "to_ids": false, "type": "datetime", "uuid": "3bcd3470-1e36-402f-a334-5060bb866792", "value": "2026-06-15T05:15:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "ssdeep", "timestamp": "1784367682", "to_ids": true, "type": "ssdeep", "uuid": "a3435058-66d3-4248-84bc-d548dce8b9be", "value": "24:8OhrhrJuqqIf7qKrigdQzeQAlKBG52/Qpx6tydBypdjbyTATk2ii4+d1h4x:88NtZfDQalyJ/Qb6tGInyETk2L4shU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367682", "to_ids": false, "type": "size-in-bytes", "uuid": "4a50f63d-2763-4c4e-abd4-6fa604a0b804", "value": "1437" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T08:29:24+00:00", "last_seen": "2026-06-15T08:29:24+00:00", "object_relation": "filename", "timestamp": "1784367682", "to_ids": true, "type": "filename", "uuid": "93d550a9-ce45-4fac-b4ee-ec024da3fac6", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u041e\u041e \u041f\u0440\u043e\u043c\u041c\u0435\u0442\u0420\u0435\u0441\u0443\u0440\u0441 \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408068", "uuid": "579d1ddf-58ce-47be-aacf-f3a42c59cf1a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "md5", "timestamp": "1784408068", "to_ids": true, "type": "md5", "uuid": "3b5075dc-084a-49d0-84b9-0e30447257ce", "value": "331c47ac521121a03df4baba947dc7a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "sha1", "timestamp": "1784408068", "to_ids": true, "type": "sha1", "uuid": "1d1a674a-1bfe-4dff-be78-2846916ba51c", "value": "19b30140abf1b48407b0506f780bb49eb37fec6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "sha256", "timestamp": "1784408068", "to_ids": true, "type": "sha256", "uuid": "cad115f3-af11-436b-8476-8150099eb9b8", "value": "aedcfbac94161f74b2ce63ad9da2f613809860fc8aa09d6ea0b57e964c47f8a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "text", "timestamp": "1784367724", "to_ids": false, "type": "text", "uuid": "31db5b4b-5368-4621-b269-edfc9fe2e677", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-05-27T08:27:20+00:00\nLast Submission: 2026-05-27T08:27:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "creation-time", "timestamp": "1784367724", "to_ids": false, "type": "datetime", "uuid": "42dd8e07-69a5-4a64-ba51-a5aafe360580", "value": "2026-05-26T18:37:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "ssdeep", "timestamp": "1784367724", "to_ids": true, "type": "ssdeep", "uuid": "2cd48f0e-d42d-4521-8bb2-4a312c39db2f", "value": "24:8I/LlfC2iLzljz+14zQpxmXthftcfmQ9nOpvgGuOC7TkqCEaNux:8IjlfsBjSOQbm9MflnOpvgSMTkqNv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367724", "to_ids": false, "type": "size-in-bytes", "uuid": "8c30fc3e-eb95-4824-9405-bd938d6ae4cc", "value": "1461" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:27:20+00:00", "last_seen": "2026-05-27T08:27:20+00:00", "object_relation": "filename", "timestamp": "1784367724", "to_ids": true, "type": "filename", "uuid": "6f75b61e-6104-4454-8159-90283587d5b9", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u041e\u041e \u0422\u041f\u041f \u042d\u043d\u0435\u0440\u0433\u043e\u041c\u043e\u0434\u0443\u043b\u044c \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408073", "uuid": "30c933ee-307f-4b0d-b405-a85522194b4a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "md5", "timestamp": "1784408072", "to_ids": true, "type": "md5", "uuid": "3e474040-92c4-4ef0-ada3-b9d463b28c4f", "value": "ef33b14288edc02b441e6372de4149e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "sha1", "timestamp": "1784408073", "to_ids": true, "type": "sha1", "uuid": "a4a0f4ae-3f82-4859-af89-0e5278b72a6d", "value": "0193adda1b2a2264ede65170e5f183bac7331f93", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "sha256", "timestamp": "1784408073", "to_ids": true, "type": "sha256", "uuid": "ae137f4b-5ddf-4a60-aa29-951bafde69bb", "value": "b2e8f9f9a69c1be0d1814b064b73586afbf730e2ab9d9fb10dd5711be4febe85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "text", "timestamp": "1784367745", "to_ids": false, "type": "text", "uuid": "adfc96ab-2430-4254-8aa9-62edc86368fc", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-05-12T13:12:08+00:00\nLast Submission: 2026-05-12T13:12:08+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "creation-time", "timestamp": "1784367745", "to_ids": false, "type": "datetime", "uuid": "a520ad20-cb83-49e6-abd1-f554ec969fcd", "value": "2026-05-11T13:06:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "ssdeep", "timestamp": "1784367745", "to_ids": true, "type": "ssdeep", "uuid": "9d0c058c-1e76-4930-836a-ebea823a2287", "value": "12:8O0oHJsWJVU8yWj4SHJo6VWJs8XMVWaniyWfXSKULkBjjSCElO6hcue39ci:8GJvnJfKeibiKUYBCCafmVNx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T13:12:08+00:00", "last_seen": "2026-05-12T13:12:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367745", "to_ids": false, "type": "size-in-bytes", "uuid": "7df97e5f-9d6b-41ce-93c1-4c2f22ae42ad", "value": "737" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408076", "uuid": "b51c6ddb-c24b-464e-b5ec-00cbfa5e292d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "md5", "timestamp": "1784408075", "to_ids": true, "type": "md5", "uuid": "d92b0f47-fd37-42e1-ad0f-7bb7cba6b3fc", "value": "265c754cdfeb1ab5b1aeb3a97b34f4b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "sha1", "timestamp": "1784408075", "to_ids": true, "type": "sha1", "uuid": "afd6a916-0ee6-473e-9016-d69b6918c39f", "value": "27b8eaa0b115bfb7aa081f81b9d0552ec05e5feb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "sha256", "timestamp": "1784408076", "to_ids": true, "type": "sha256", "uuid": "67a09792-2013-4885-9ead-b7134422e99c", "value": "b90a7f17b5406db3ee17ec4bc82a704c6128b4ad8652776b4f55bc3948fa8385", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "text", "timestamp": "1784367788", "to_ids": false, "type": "text", "uuid": "aaf7355b-ae7e-40ac-b40f-6b2cc9afeb64", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 19/74\nFirst Submission: 2026-05-27T08:26:57+00:00\nLast Submission: 2026-05-27T08:26:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "ssdeep", "timestamp": "1784367788", "to_ids": true, "type": "ssdeep", "uuid": "a448fd30-5a4d-4be1-85ba-9130a500e18c", "value": "24576:i3h+OaloJ2q0KC3k8z6uCw/GYozOiiPZOl85Guk7l:i3wnlEi3kKCw/3ozJuYkWx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367788", "to_ids": false, "type": "size-in-bytes", "uuid": "0e4b159d-4d2f-404a-a149-5eebedcad910", "value": "1119761" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T08:26:57+00:00", "last_seen": "2026-05-27T08:26:57+00:00", "object_relation": "vhash", "timestamp": "1784367788", "to_ids": true, "type": "vhash", "uuid": "53d7ddc6-e974-4645-aee3-6c7c7aee0bbc", "value": "61d0a26782cf551ea11281acc2709a45" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408079", "uuid": "5f123756-56f5-4888-b14b-f4ef207d222f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "md5", "timestamp": "1784408078", "to_ids": true, "type": "md5", "uuid": "4d90acc8-3a58-43b4-8ef0-df860a9e091a", "value": "4f830e294472a3254819d0be804b068b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "sha1", "timestamp": "1784408078", "to_ids": true, "type": "sha1", "uuid": "ea932131-b9ab-4247-9635-e30127ceddb1", "value": "c4a0ca319b4bb8f0ac16ddb8f31abdb874239beb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "sha256", "timestamp": "1784408079", "to_ids": true, "type": "sha256", "uuid": "3487216d-4a2d-4438-9784-bc1a38918578", "value": "c709c30074155f8f0a431828c23cc08df6959505051578ec28659a47a4da2fa6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "text", "timestamp": "1784367809", "to_ids": false, "type": "text", "uuid": "dc7766b7-c7cf-4dd8-9ee0-238a2d714c7a", "value": "Type Description: INI\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-04-30T07:50:07+00:00\nLast Submission: 2026-04-30T07:50:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "ssdeep", "timestamp": "1784367809", "to_ids": true, "type": "ssdeep", "uuid": "cc31753e-63c0-4d7b-bb54-065df5759e9e", "value": "6:O/oPXZZk4xRPjwxVDCKWdDKHMoEEjLgpW2MSuKIXZNWYpPM/iosi6a8l6i7Ib:XTZR7wxwP8JjjqW2MSulNBPM/ioD8l6X" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367809", "to_ids": false, "type": "size-in-bytes", "uuid": "201ce7ee-d88e-425c-bc8f-934857ecec13", "value": "266" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "filename", "timestamp": "1784367809", "to_ids": true, "type": "filename", "uuid": "37d7b6b5-eaa1-4fba-b501-bf1594985d95", "value": "nsm.lic" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408081", "uuid": "3c56b0a5-3be5-4a28-ad6b-fd6e45ab1dba", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "md5", "timestamp": "1784408080", "to_ids": true, "type": "md5", "uuid": "e7920e5e-dda9-4c91-a3de-56119bbecba2", "value": "57c8228142b4355e8c66b6e2a4e38ed7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "sha1", "timestamp": "1784408081", "to_ids": true, "type": "sha1", "uuid": "2ee435a6-5e0c-4e1f-bb3c-62ecb9c3da52", "value": "0513aeb08995eb90bd0943749f83061c614e5393", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "sha256", "timestamp": "1784408081", "to_ids": true, "type": "sha256", "uuid": "5c018035-b163-47f0-8116-a2595bd72a96", "value": "fa07773b3af0539442504f86973fe2a68e040f80ebea388c5ed62d8f94eddb6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "text", "timestamp": "1784367914", "to_ids": false, "type": "text", "uuid": "c6d52952-485b-4cd4-816a-cc70665e8ee6", "value": "Type Description: INI\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-04-30T07:50:07+00:00\nLast Submission: 2026-04-30T07:50:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "ssdeep", "timestamp": "1784367914", "to_ids": true, "type": "ssdeep", "uuid": "69df6448-7a9b-4a10-ba27-37f864da6f40", "value": "12:rqH+Z5QGSyLBa/vpVSXCxOZ7CCPfu8KZjCYublutJZx7GJu:rqewU8zxOLrKHusjp7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367914", "to_ids": false, "type": "size-in-bytes", "uuid": "ea20ab0f-c543-4a6d-9837-f11d62508c93", "value": "645" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:50:07+00:00", "last_seen": "2026-04-30T07:50:07+00:00", "object_relation": "filename", "timestamp": "1784367914", "to_ids": true, "type": "filename", "uuid": "63c0f57d-f998-4d9a-931e-425f8421fb58", "value": "client32.ini" } ] } ] } }