{
  "Event": {
    "analysis": "1",
    "date": "2026-06-06",
    "extends_uuid": "",
    "info": "[Threat Intel] MA-1451.062026: MyCERT Advisory - Multi-Variant Android Banking Trojan Campaign Targeting Malaysian Banking Users (Delivery4U / KerjaExpress / MaxTag)",
    "protected": false,
    "publish_timestamp": "1782536583",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782536532",
    "uuid": "c0fb7f53-b749-40f8-99b8-b7339530bb6f",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#170059",
        "local": false,
        "name": "rectifyq:topic=\"mobile-attack\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#dd2e44",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Device Lockout - T1446\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Capture SMS Messages - T1412\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade as Legitimate Application - T1444\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Social Engineering - T1684\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Accessibility Features - T1453\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"",
        "relationship_type": ""
      },
      {
        "colour": "#57b2ae",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Android\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782365912",
        "to_ids": false,
        "type": "link",
        "uuid": "b5f3845b-3f99-478e-9065-eea4e9eb66ef",
        "value": "https://www.mycert.org.my/portal/advisory?id=MA-1451.062026"
      },
      {
        "category": "Network activity",
        "comment": "Active C2 / payload host (nginx/1.18.0, Ubuntu)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468038",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e6da4b67-3b9d-4033-98db-62532f48c7aa",
        "value": "209.92.170.40",
        "Tag": [
          {
            "colour": "#7938e4",
            "local": false,
            "name": "asn:asn=\"21769\"",
            "relationship_type": ""
          },
          {
            "colour": "#0adc89",
            "local": false,
            "name": "asn:as-owner=\"AS-COLOAM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Legacy C2 host",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468061",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0001cf89-8181-46cb-9a84-7dce22ceda3f",
        "value": "142.91.101.182",
        "Tag": [
          {
            "colour": "#77f9d4",
            "local": false,
            "name": "asn:asn=\"59253\"",
            "relationship_type": ""
          },
          {
            "colour": "#5b3a52",
            "local": false,
            "name": "asn:as-owner=\"LEASEWEB-APAC-SIN-11 LEASEWEB SINGAPORE PTE. LTD.\"",
            "relationship_type": ""
          },
          {
            "colour": "#d906de",
            "local": false,
            "name": "asn:as-country=\"SG\"",
            "relationship_type": ""
          },
          {
            "colour": "#ad61df",
            "local": false,
            "name": "misp-galaxy:country=\"singapore\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "WebSocket C2 (MTDIS variant)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782365978",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "8fb0de08-3b4e-4818-b254-7e644d6e5210",
        "value": "195.160.221.203|8080"
      },
      {
        "category": "Payload delivery",
        "comment": "Stage 4 payload (ads.txt, encrypted) No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782467503",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d1657845-9c9d-4276-950d-9d97fb58f752",
        "value": "de5cc3b4d5f34aabfc13d94f13c63670f481cf74dad66cde19b8e920031fdc89",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782468083",
        "uuid": "bf537568-686d-46ff-95f4-0d1a8e0ad882",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "D4Ucod.apk",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782468083",
            "to_ids": true,
            "type": "md5",
            "uuid": "b0fdbec6-cd3e-4b21-972d-36f0cee73b34",
            "value": "ba7c0059d2236bf914c26ce8034ab1bf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "D4Ucod.apk",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467498",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9bbc6617-05ca-4ee2-8892-2543fcea8d6e",
            "value": "392c7d16eb17289daad76cd24d8c445d0d9cc475",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "D4Ucod.apk",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467499",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7bbb8637-86b3-4dca-9fc0-f44a00a7ec5f",
            "value": "d7e6a9171fb2c3ec8c66b2613e35096d1b2815fbfc6b1317425ddcd834f2107d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467081",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "845c716f-c68a-4794-ad9f-c8bcd3857442",
            "value": "49152:5ABgZLJ7i0rwFYBmbYp+PgNi5JnXVw5aHpgBvHAOC4klSqWZmX0BpkxET2gkpN:5z7i0rwFbvgEXVQ/AnflSj0EzeEig0N"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467081",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6f6f446f-e866-4b1a-9940-58a911cf2655",
            "value": "3664535"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467081",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7b18f230-6d74-4b19-afda-aa35a967c474",
            "value": "28c16e2f01f22b206a5385edf0a5d2d9"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467081",
            "to_ids": true,
            "type": "filename",
            "uuid": "ab0ebf8a-8bae-46ee-a64b-c55c7cae08ea",
            "value": "D4Ucod.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467081",
            "to_ids": false,
            "type": "text",
            "uuid": "3a3d4eec-d603-4f14-a117-3bea7bb57ec8",
            "value": "D4Ucod.apk\r\nType Description: Android\nMicrosoft: None\nVT Total Detection:21/65\nFirst Submission:2026-06-02T09:25:40.000000+00:00\nLast Submission:2026-06-02T12:52:59.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782468105",
        "uuid": "6439a191-261a-41bb-90eb-f140ec26db18",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Stage 3 APK (musics.emitter.indexer)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782468105",
            "to_ids": true,
            "type": "md5",
            "uuid": "737fa205-e9e2-4476-8f2f-4d9400bad81d",
            "value": "609ea1b31d73c66eec9086e5e2bc3f45",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Stage 3 APK (musics.emitter.indexer)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467501",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8c234c39-cba3-4c71-9c04-fc4b5bbadfae",
            "value": "87a4e7bdee8efd085176a0634bd8ec867be84333",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Stage 3 APK (musics.emitter.indexer)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467501",
            "to_ids": true,
            "type": "sha256",
            "uuid": "85f45272-9e69-4dc1-8baa-49e01710ee23",
            "value": "14163257cb7ea7956144b8c2ebc2d24cada04a2772e3aa8f967f93ef1718252f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467105",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9653dfd9-2a9b-492c-8676-684239b94381",
            "value": "98304:8o/KrRSNauB8Pxvo7TQN69VR2iasearTn7sE7Fbls1CEf9jJFKQdzu49WNGpSHcC:3auCPxcx/a0737FRCCIUszuZafZ6H"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467105",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0461d25c-8551-4523-831e-1299724d6ef4",
            "value": "7300528"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467105",
            "to_ids": true,
            "type": "vhash",
            "uuid": "03c1ee8d-d3cc-41fa-b0af-1dd117cc552a",
            "value": "929c553710df84dc9254f88ffcb121f9"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467105",
            "to_ids": true,
            "type": "filename",
            "uuid": "ad9b1ecc-5465-407b-87cd-55ca57172428",
            "value": "data.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467105",
            "to_ids": false,
            "type": "text",
            "uuid": "b4ad8655-1230-4561-8439-bd764e85e450",
            "value": "Stage 3 APK (musics.emitter.indexer)\r\nType Description: Android\nMicrosoft: None\nVT Total Detection:36/66\nFirst Submission:2026-06-02T12:10:05.000000+00:00\nLast Submission:2026-06-02T12:10:05.000000+00:00"
          }
        ]
      }
    ]
  }
}