{ "Event": { "analysis": "1", "date": "2026-07-08", "extends_uuid": "", "info": "[Threat Intel] Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories", "protected": false, "publish_timestamp": "1784349308", "published": true, "threat_level_id": "2", "timestamp": "1784349307", "uuid": "ca4330b7-d8f9-468d-a959-611002dbe6a8", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#d74cce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": "" }, { "colour": "#201172", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Dependencies and Development Tools - T1195.001\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#8d021b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#18005e", "local": false, "name": "rectifyq:topic=\"supply-chain\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1685\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#d82db7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AsyncRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Quasar RAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Vidar\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"xmrig\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652415", "to_ids": false, "type": "link", "uuid": "44074d99-efa8-4770-b9e7-0f189dd748ad", "value": "https://socket.dev/blog/malicious-go-module-exposes-github-malware-lure-network" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783652415", "to_ids": false, "type": "text", "uuid": "e04252d3-bfb2-45e5-baa5-11a2491f282b", "value": "A malicious Go module posing as a DNS/subdomain scanner exposed a sophisticated Windows malware staging operation utilizing commit-farming workflows, public dead drops, and protected archives to deploy RAT and infostealer malware. The operation, tracked as 'Muck and Load', leverages a GitHub-based infrastructure comprising 222 confirmed repositories across 190 accounts designed to appear active and legitimate through automated GitHub Actions workflows. The attack chain begins with a deceptive Go module that downloads encoded PowerShell content, which then queries multiple public platforms including Pastebin, Telegram, YouTube, and Instagram as dead drops for encrypted payload locations. The loader retrieves password-protected archives containing AsyncRAT, Quasar, Remcos, and Vidar infostealer payloads, executing them from masqueraded Microsoft-themed directories. At least 14 malware files were confirmed across the repository network." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783652415", "to_ids": false, "type": "text", "uuid": "a72e12e8-2f3b-4f95-b8d7-2056d0a09559", "value": "Name: Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories\nAuthor: AlienVault\nAdversary: \nTags: [\"asyncrat\", \"go module\", \"vidar\", \"quasar\", \"operation muck and load\", \"commit farming\", \"powershell loader\", \"github lure network\", \"xmrig\", \"dead drop resolver\", \"remcos\"]\nTgtd countries: []\nMlwr families: [\"AsyncRAT\", \"Quasar\", \"Remcos\", \"Vidar\", \"XMRig\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1548.002\", \"T1195.001\", \"T1036.005\", \"T1204.002\", \"T1543.003\", \"T1140\", \"T1608.001\", \"T1055\", \"T1112\", \"T1555.003\", \"T1059.001\", \"T1027\", \"T1564.003\", \"T1071.001\", \"T1105\", \"T1102.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344847", "to_ids": true, "type": "domain", "uuid": "71eb4508-7e59-4eeb-a427-bcf26b3b7a4f", "value": "rlim.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344868", "to_ids": true, "type": "domain", "uuid": "95193290-ba85-40f3-901d-4383f8449180", "value": "muckdeveloper.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344889", "to_ids": true, "type": "domain", "uuid": "68079101-a8b3-4698-bf71-f43de55d767f", "value": "muckcoding.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344910", "to_ids": true, "type": "url", "uuid": "cd42f0f2-0737-4381-9c80-331ac1de485a", "value": "https://muckcoding.com/LG-LW/Api-Certificate", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344931", "to_ids": true, "type": "url", "uuid": "072c6149-bb34-4c59-bb00-53851f57bd0f", "value": "https://rlim.com/MicrosoftCur/raw", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344952", "to_ids": true, "type": "url", "uuid": "93d7a5d5-196f-42eb-985d-2056e63a0ed0", "value": "https://muckdeveloper.com/LGTV/MicrosoftCur", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344320", "to_ids": true, "type": "sha256", "uuid": "0db13a18-be28-4e31-8a1a-b16dcd065211", "value": "129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344320", "to_ids": true, "type": "sha256", "uuid": "aa2afc34-f23b-4b55-873a-603fe2e4cfc8", "value": "86819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344322", "to_ids": true, "type": "sha256", "uuid": "5a2c838f-edc2-46fd-a467-73f124699787", "value": "57e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344323", "to_ids": true, "type": "sha256", "uuid": "f04960a1-bdae-4aa7-aada-4503bb3f45db", "value": "e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344324", "to_ids": true, "type": "sha256", "uuid": "7d35594d-1b6a-40fa-a8f1-6b350fff7f65", "value": "51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344325", "to_ids": true, "type": "sha256", "uuid": "530eae94-5cd8-438c-abb4-90f15b5d5e89", "value": "73c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344326", "to_ids": true, "type": "sha256", "uuid": "a49a41a6-09c5-4471-9487-832d9930a20d", "value": "a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784344974", "to_ids": true, "type": "url", "uuid": "35cf683e-20fb-401a-bc2a-2a4d8046eb32", "value": "http://muckcoding.com/LG-LW/Api-Certificate", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784344995", "uuid": "38266191-e93b-478d-be80-aeba80307620", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "md5", "timestamp": "1784344995", "to_ids": true, "type": "md5", "uuid": "b52703fd-ea9b-47ad-8963-37c820d2ae0a", "value": "9ec75e0a4432ff9fc50b38d0e373c5a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "sha1", "timestamp": "1784344298", "to_ids": true, "type": "sha1", "uuid": "4376acaa-c69d-415b-bbb3-33619eb4045f", "value": "c8aee5a72b00757d858adeab03888a8a592b02ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "sha256", "timestamp": "1784344298", "to_ids": true, "type": "sha256", "uuid": "7459625d-3d5c-4b4f-a341-3eb55ce19001", "value": "b27f694c974b44fe2f4a8a25680997db574fa35686c30fa4c4dc9dd4ec40005e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "text", "timestamp": "1784337415", "to_ids": false, "type": "text", "uuid": "0391077c-b15d-4c0e-b58a-559fa4ffbb33", "value": "Type Description: Win32 EXE\nOriginal name: Default.exe\nMicrosoft: Trojan:MSIL/Zilla!pz\nClamAV: Win.Downloader.Msilzilla-10016022-0\nVT Total Detection: 38/74\nFirst Submission: 2023-11-07T21:26:14+00:00\nLast Submission: 2024-11-05T20:34:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "creation-time", "timestamp": "1784337416", "to_ids": false, "type": "datetime", "uuid": "5abf8767-8ad8-4622-9d5c-0fda19985bcc", "value": "2090-07-24T07:13:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "ssdeep", "timestamp": "1784337415", "to_ids": true, "type": "ssdeep", "uuid": "0497b8fc-9d9d-4e9c-9e24-42edd4a131a4", "value": "192:7KZQl5ZhVojVYM0P20KptLd2Xi8M7VJWGaG7qfLJh6Oi1xWD:6yDG91aTzJh+1xW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337415", "to_ids": false, "type": "size-in-bytes", "uuid": "cded5412-e5e7-4bce-ab67-697d94c74917", "value": "46592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "vhash", "timestamp": "1784337415", "to_ids": true, "type": "vhash", "uuid": "4cdfb3ae-5d4b-4432-847f-c7f469ed0faf", "value": "244036551516082160010" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-11-07T21:26:14+00:00", "last_seen": "2024-11-05T20:34:25+00:00", "object_relation": "filename", "timestamp": "1784337415", "to_ids": true, "type": "filename", "uuid": "61745b2e-b01c-48b4-ba5e-926ce9719d17", "value": "Default.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345015", "uuid": "024672b0-185c-4b13-8cd6-44ec773f22b3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "md5", "timestamp": "1784345015", "to_ids": true, "type": "md5", "uuid": "d7344f8c-e2a6-4871-bd5f-e67c23b155b5", "value": "0aaea95ad6ef4a9baf02ae05289af617", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "sha1", "timestamp": "1784344300", "to_ids": true, "type": "sha1", "uuid": "35e42c0c-d465-42a9-adb2-9624eff970f2", "value": "25d585a291235936eca70402fbb567017aad860a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "sha256", "timestamp": "1784344300", "to_ids": true, "type": "sha256", "uuid": "d3863f97-0d26-4ecb-b11e-03ab0af2121d", "value": "ec1cac2ada6726623b4bafb94c204c359ce7cdf5325909137fc0e6aef506783f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "text", "timestamp": "1784337437", "to_ids": false, "type": "text", "uuid": "002e3015-ef81-4096-bf82-826f5c69d8d9", "value": "Type Description: Win32 EXE\nOriginal name: Particle.exe\nMicrosoft: TrojanSpy:MSIL/Stealer.AIB!MTB\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2025-10-23T19:41:25+00:00\nLast Submission: 2025-11-16T00:55:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "creation-time", "timestamp": "1784337437", "to_ids": false, "type": "datetime", "uuid": "3097ca0e-a7d0-4fed-9b10-d3bd4ddcc3db", "value": "2049-03-01T21:04:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "ssdeep", "timestamp": "1784337437", "to_ids": true, "type": "ssdeep", "uuid": "80fcf5d4-295b-43dc-8c52-3406ce243d47", "value": "192:LvsMl4ifvVikH75EjdmtNAWlG9rL9e/uH3710H3n+En+cXpxsOFuTwI9S8:xtFb5odCNTCH9e/4SH3nPnf5Fusm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337437", "to_ids": false, "type": "size-in-bytes", "uuid": "06b67c5a-0be6-4ea9-a55d-9b782092bea0", "value": "11264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "vhash", "timestamp": "1784337437", "to_ids": true, "type": "vhash", "uuid": "0ddf9750-f03e-4e07-95f6-0fc01fb84cf0", "value": "21403655151d083d60021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-23T19:41:25+00:00", "last_seen": "2025-11-16T00:55:56+00:00", "object_relation": "filename", "timestamp": "1784337437", "to_ids": true, "type": "filename", "uuid": "2cb4b4d0-c2b0-4268-bddf-0cd1550c9521", "value": "Particle.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345036", "uuid": "0296d46d-aba0-4896-aa3d-246c2a92d57f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "md5", "timestamp": "1784345036", "to_ids": true, "type": "md5", "uuid": "e76b9e50-f16a-494d-a370-6bb235392e09", "value": "458e4c64738e8f46e997eea7cb32a296", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "sha1", "timestamp": "1784344301", "to_ids": true, "type": "sha1", "uuid": "25215a74-2af7-467d-8c3c-a3d82de6aa95", "value": "1a9bbae96ab7a852312b802fd3694211f3bbc43f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "sha256", "timestamp": "1784344301", "to_ids": true, "type": "sha256", "uuid": "75385813-1a9e-46c0-bf6b-893dc98abefa", "value": "2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "text", "timestamp": "1784337458", "to_ids": false, "type": "text", "uuid": "5df8cb8c-d0fb-42e7-bc2f-553581588996", "value": "Type Description: Win32 EXE\nOriginal name: script.exe\nMicrosoft: Trojan:MSIL/Vidar.AVI!MTB\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2025-11-30T18:35:14+00:00\nFirst Submission: 2025-11-26T11:38:09+00:00\nLast Submission: 2026-06-29T06:27:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "creation-time", "timestamp": "1784337458", "to_ids": false, "type": "datetime", "uuid": "a185f816-17dc-4f2b-a027-9848ee3ab92e", "value": "2025-11-22T22:18:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "ssdeep", "timestamp": "1784337458", "to_ids": true, "type": "ssdeep", "uuid": "45ec5341-6c1f-4497-8ecf-585f569047a2", "value": "768:lmQZqx1lYcJnqnaFFzv1Iw2K3omDe0XbOfC11kq0m:l0lYov1Iw13omCMbO/q0m" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337458", "to_ids": false, "type": "size-in-bytes", "uuid": "c7b7a89c-43c3-4e7c-ac85-d1bf819a4932", "value": "36864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "vhash", "timestamp": "1784337458", "to_ids": true, "type": "vhash", "uuid": "2983063b-735d-4b77-ac9f-0e8fcbbd869f", "value": "2340365515119075603f5083" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-26T11:38:09+00:00", "last_seen": "2026-06-29T06:27:55+00:00", "object_relation": "filename", "timestamp": "1784337458", "to_ids": true, "type": "filename", "uuid": "225f9c00-7476-4be8-a28f-3b80e2a41aaf", "value": "script.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345058", "uuid": "704b8289-d4cb-4683-b5b9-cf2b0b405fa0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "md5", "timestamp": "1784345058", "to_ids": true, "type": "md5", "uuid": "a186ae50-3fe2-4332-a836-3630be428ee8", "value": "64eb7ad3aaf9b6639ccc5c0b30b6e59f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "sha1", "timestamp": "1784344302", "to_ids": true, "type": "sha1", "uuid": "b5c7c09c-6ee4-4ab7-9822-f00c226ee283", "value": "1eb377e01e1e649b3290efb0160f25cb5d13bd21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "sha256", "timestamp": "1784344303", "to_ids": true, "type": "sha256", "uuid": "7c66b811-a055-422e-a278-cf507f064b5b", "value": "9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "text", "timestamp": "1784337480", "to_ids": false, "type": "text", "uuid": "5224359c-c6dc-492c-a7a2-bf50ef91d1e8", "value": "Type Description: Win32 EXE\nOriginal name: script.exe\nMicrosoft: Trojan:MSIL/Vidar.AVI!MTB\nClamAV: None\nVT Total Detection: 56/74\nFirst Seen In The Wild: 2026-04-24T12:35:25+00:00\nFirst Submission: 2026-04-24T10:12:48+00:00\nLast Submission: 2026-07-17T21:53:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "creation-time", "timestamp": "1784337480", "to_ids": false, "type": "datetime", "uuid": "f07b175b-49ba-42e3-8488-4ce8d6feb58a", "value": "2026-04-24T08:33:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "ssdeep", "timestamp": "1784337480", "to_ids": true, "type": "ssdeep", "uuid": "6a797704-e103-409c-b218-a869fef1b08c", "value": "768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337480", "to_ids": false, "type": "size-in-bytes", "uuid": "e0d6fa16-3ba5-4dc1-965b-876a76b1b000", "value": "36864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "vhash", "timestamp": "1784337480", "to_ids": true, "type": "vhash", "uuid": "c1c5af2b-c183-4cce-b7a4-493a34dc5a64", "value": "2340365515119073613f5083" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-24T10:12:48+00:00", "last_seen": "2026-07-17T21:53:25+00:00", "object_relation": "filename", "timestamp": "1784337480", "to_ids": true, "type": "filename", "uuid": "e5d735c2-7b2a-46bd-9caa-12530c96741d", "value": "script.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345079", "uuid": "d2f1b7b9-a626-4107-88be-c6f88038263c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "md5", "timestamp": "1784345079", "to_ids": true, "type": "md5", "uuid": "10513d92-0a16-4a10-999b-7ca764b14758", "value": "ca55dffc4b305a54158734533a322c3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "sha1", "timestamp": "1784344304", "to_ids": true, "type": "sha1", "uuid": "e728dff7-98aa-45ae-b24f-29721d7eb869", "value": "57cd17e88e4f64efb9681fa45c8845c337c05751", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "sha256", "timestamp": "1784344304", "to_ids": true, "type": "sha256", "uuid": "3ea91f97-f827-421e-8867-d801b418a414", "value": "969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "text", "timestamp": "1784337607", "to_ids": false, "type": "text", "uuid": "4a9b2e05-2769-41f6-a705-69cc90a961f6", "value": "Type Description: Powershell\nMicrosoft: TrojanDownloader:PowerShell/Malgent!MSR\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2025-12-25T16:06:45+00:00\nLast Submission: 2026-02-07T08:28:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "ssdeep", "timestamp": "1784337607", "to_ids": true, "type": "ssdeep", "uuid": "1aa8fec9-d248-49bd-a2ee-2f4273a51489", "value": "96:90RoWKMNO9W/LHj/EB/MEwXcHuNur/vOYd0CUNIeC9Bi4lPcdwfGnrGZ4mcu1LxQ:eWG/LHjsJMEwXc3OYOjNInlLnqEQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337607", "to_ids": false, "type": "size-in-bytes", "uuid": "392614ba-754b-40e2-8816-a9f47c91cf5b", "value": "11620" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "vhash", "timestamp": "1784337607", "to_ids": true, "type": "vhash", "uuid": "7e6a69f5-ec57-4d8b-934c-d4627f3bdb0c", "value": "df67790008a68e80b314e85257c5bb67" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-25T16:06:45+00:00", "last_seen": "2026-02-07T08:28:30+00:00", "object_relation": "filename", "timestamp": "1784337607", "to_ids": true, "type": "filename", "uuid": "c0db7fa4-7642-41b5-8e04-8c3be1ef9066", "value": "mal.ps1.ps1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345100", "uuid": "5b631579-6dc7-48f8-852e-e53c217a23d5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "md5", "timestamp": "1784345100", "to_ids": true, "type": "md5", "uuid": "50e7b565-186b-4eab-8d80-22433b9fa4f7", "value": "da9f401a7e4eea950599ed57d6283edf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "sha1", "timestamp": "1784344305", "to_ids": true, "type": "sha1", "uuid": "3553352e-4617-4402-ac1e-f446cc99e297", "value": "354ced538a5ff750c1235b630b781d5e9358cd23", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "sha256", "timestamp": "1784344305", "to_ids": true, "type": "sha256", "uuid": "8b73abb5-c9ab-4205-afb1-4c294324b160", "value": "4ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "text", "timestamp": "1784337670", "to_ids": false, "type": "text", "uuid": "4ebd4636-bfe2-4123-bc74-0ae09e9438c2", "value": "Type Description: Win32 EXE\nOriginal name: Exodus.exe\nVerified: Signed\nSigning date: 05:29 PM 10/11/2024\nSigners: Exodus Movement, Inc.; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2024-10-11T19:47:05+00:00\nLast Submission: 2026-05-22T15:26:17+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "creation-time", "timestamp": "1784337670", "to_ids": false, "type": "datetime", "uuid": "32708845-01e4-48d0-8769-6ac73e7ea8a8", "value": "2024-09-05T21:54:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "ssdeep", "timestamp": "1784337670", "to_ids": true, "type": "ssdeep", "uuid": "96d8f041-956d-4b64-9e5e-3524881f5559", "value": "1572864:RbrOrBzMzME3lL+fpSICUfmmgcAeWgIdTykJN+wszjdxSrsxkyuYhPLaQvX6:P1kJ+QvK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337670", "to_ids": false, "type": "size-in-bytes", "uuid": "09e535f3-53b1-4812-8311-bcfbc0c580d9", "value": "180988776" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "vhash", "timestamp": "1784337670", "to_ids": true, "type": "vhash", "uuid": "3788062c-ef97-419d-bbf1-74acae774d48", "value": "0180f6656d156550161d14z1b2zff3z72z143z77z3001f334zc49" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-11T19:47:05+00:00", "last_seen": "2026-05-22T15:26:17+00:00", "object_relation": "filename", "timestamp": "1784337670", "to_ids": true, "type": "filename", "uuid": "118e7a82-3961-40f5-8aa7-7152fdab39e5", "value": "Exodus.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345121", "uuid": "34043a51-bc3e-4707-8ddb-e595a6d82b97", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "md5", "timestamp": "1784345121", "to_ids": true, "type": "md5", "uuid": "a25ac5f7-96fa-4bab-9ed0-51bed392b651", "value": "5be1c4cacb5ae37c43527e99a097dc7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "sha1", "timestamp": "1784344306", "to_ids": true, "type": "sha1", "uuid": "d0d7e7a0-4fbf-4897-8912-ebd4c0b3a362", "value": "1b2f00fefde9d601764d5d26d5e0fb2b9f58074c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "sha256", "timestamp": "1784344306", "to_ids": true, "type": "sha256", "uuid": "5a6a0f87-4581-498b-b152-ff5a814b512b", "value": "235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "text", "timestamp": "1784337692", "to_ids": false, "type": "text", "uuid": "eaf95c95-f550-47b5-8b8b-2e6543851928", "value": "Type Description: DOS batch file\nMicrosoft: None\nClamAV: None\nVT Total Detection: 7/74\nFirst Seen In The Wild: 2023-06-03T04:22:00+00:00\nFirst Submission: 2023-05-18T05:35:47+00:00\nLast Submission: 2026-07-10T09:53:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "ssdeep", "timestamp": "1784337692", "to_ids": true, "type": "ssdeep", "uuid": "1e00f040-9d6b-4f4e-9133-814e5663a689", "value": "3:mKDD3M/PKXD0dAyIgytoyrIJnn:h7dXD0frsoD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337692", "to_ids": false, "type": "size-in-bytes", "uuid": "6816b467-309e-465f-aac4-e831d3ba8658", "value": "61" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-05-18T05:35:47+00:00", "last_seen": "2026-07-10T09:53:25+00:00", "object_relation": "filename", "timestamp": "1784337692", "to_ids": true, "type": "filename", "uuid": "0e3683ad-63c2-4805-9913-6356d5d9012d", "value": "benchmark_10M.cmd" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345142", "uuid": "2ef73a6f-7b3f-4e55-a0b6-93b36b7e494b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "md5", "timestamp": "1784345142", "to_ids": true, "type": "md5", "uuid": "763f2210-3219-4824-a852-42f6e73f674d", "value": "090703e56f46330ed625ac4363c9d25c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "sha1", "timestamp": "1784344308", "to_ids": true, "type": "sha1", "uuid": "7d3cb2ca-6f4e-4d2b-8559-89245063617d", "value": "6ce0b265e0860f1913f4bb37a17aa7eda88641c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "sha256", "timestamp": "1784344308", "to_ids": true, "type": "sha256", "uuid": "4738dc77-3146-44af-bd42-81ba66564031", "value": "33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "text", "timestamp": "1784337713", "to_ids": false, "type": "text", "uuid": "6ed50fc0-c4dd-4cc8-9943-15263ee07334", "value": "Type Description: DOS batch file\nMicrosoft: None\nClamAV: None\nVT Total Detection: 8/74\nFirst Seen In The Wild: 2023-09-28T17:49:37+00:00\nFirst Submission: 2023-06-03T18:49:47+00:00\nLast Submission: 2026-07-14T13:14:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "ssdeep", "timestamp": "1784337713", "to_ids": true, "type": "ssdeep", "uuid": "624b7136-be6b-4f08-9a56-427db9981b7b", "value": "24:knTC6jGoTcC6gaO8oAZvfa6Tz7nR7O+ORxAIHnV+XD/X:8TdNAzOr0a6Tz7nR7OhzVwX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337713", "to_ids": false, "type": "size-in-bytes", "uuid": "177d6df5-7876-4c44-8eff-ef1e6fbcbc72", "value": "821" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-07-14T13:14:10+00:00", "object_relation": "filename", "timestamp": "1784337713", "to_ids": true, "type": "filename", "uuid": "3dc56f00-3ab5-4dc1-8d8a-09c1ba7b981a", "value": "solo_mine_example.cmd" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345163", "uuid": "6ef08306-e259-4019-9c4a-9d224b337ec3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "md5", "timestamp": "1784345163", "to_ids": true, "type": "md5", "uuid": "8fb46dab-8b24-442a-920d-b0dac96c6ce4", "value": "5c77308eadf96e015eee9bc1286db9b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "sha1", "timestamp": "1784344309", "to_ids": true, "type": "sha1", "uuid": "82fbb6bb-598b-4839-b18e-3d9513d52dbf", "value": "05131c9b0464622ebd574b66c2497665b5e01629", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "sha256", "timestamp": "1784344309", "to_ids": true, "type": "sha256", "uuid": "1002e72c-3f02-4069-95b2-fdc3dac6f467", "value": "45126b353f1636103da356121cd00b229b635b41b99d91166e6d7d9037482242", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "text", "timestamp": "1784337736", "to_ids": false, "type": "text", "uuid": "ec5177a4-2594-4523-bcc6-b28fc70e7ae1", "value": "Type Description: Shell script\nMicrosoft: None\nClamAV: None\nVT Total Detection: 20/74\nFirst Seen In The Wild: 2024-08-16T16:53:13+00:00\nFirst Submission: 2024-04-23T11:33:28+00:00\nLast Submission: 2025-11-09T14:13:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "ssdeep", "timestamp": "1784337736", "to_ids": true, "type": "ssdeep", "uuid": "bb4f3a53-288f-47f8-bb85-ddc99aee986e", "value": "6:hTNfMnGTBZ7oVScBsX6ygQfsITjylKvf3x7tHNQSMLiwW0K0PsbK84x:7MGN2odXJHsTKvfhRNQVLpWrKP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337736", "to_ids": false, "type": "size-in-bytes", "uuid": "49a22462-8423-41bb-ae2a-616d42d00f83", "value": "286" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-23T11:33:28+00:00", "last_seen": "2025-11-09T14:13:21+00:00", "object_relation": "filename", "timestamp": "1784337736", "to_ids": true, "type": "filename", "uuid": "1a20977b-e6c9-4c73-be9c-d1ba6dc0bf5d", "value": "enable_1gb_pages.sh" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345184", "uuid": "7b7988f7-8e9d-4160-829e-0b9567d7727c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "md5", "timestamp": "1784345184", "to_ids": true, "type": "md5", "uuid": "5fdd0f79-395a-4a54-af2d-8496c0699b81", "value": "3f0155abe745be1f6089eafc4f517ac8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "sha1", "timestamp": "1784344310", "to_ids": true, "type": "sha1", "uuid": "38dd8e46-077f-4395-8cf9-a6667911e815", "value": "277f510ceb62b277b141d094c82eedebdc6f3a35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "sha256", "timestamp": "1784344310", "to_ids": true, "type": "sha256", "uuid": "a86943be-53cb-4d3b-8424-ab1453331956", "value": "810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "text", "timestamp": "1784337758", "to_ids": false, "type": "text", "uuid": "b02a97c5-7c0f-4208-a10c-f8c7e89592f1", "value": "Type Description: DOS batch file\nMicrosoft: None\nClamAV: None\nVT Total Detection: 4/74\nFirst Seen In The Wild: 2023-09-28T17:49:37+00:00\nFirst Submission: 2023-04-04T05:02:32+00:00\nLast Submission: 2026-06-27T00:02:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "ssdeep", "timestamp": "1784337758", "to_ids": true, "type": "ssdeep", "uuid": "8b60e90b-ac9b-4cd2-84fe-ec262515a4a5", "value": "24:knTXzrL1ACvs4VYt5ONwvoGsPZAR0x+FcVtUtzH37CQhvvPI5E9c6I5E/Ywke:8T3G4HWPnwGsPWG+FcVK7LhvvPOMOoNt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337758", "to_ids": false, "type": "size-in-bytes", "uuid": "b78a6c18-8d04-4183-8ccf-012af02d6984", "value": "1220" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-04T05:02:32+00:00", "last_seen": "2026-06-27T00:02:15+00:00", "object_relation": "filename", "timestamp": "1784337758", "to_ids": true, "type": "filename", "uuid": "a81a47d6-0001-4fe9-ade1-4577039da1ef", "value": "rtm_ghostrider_example.cmd" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345205", "uuid": "4cae47e3-00bb-46a0-b4f8-07d3fc481d24", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "md5", "timestamp": "1784345205", "to_ids": true, "type": "md5", "uuid": "6f6dd894-86c2-49f8-84c0-be58ed95a1c8", "value": "1145f28d9b42b4a7c6deac698ada6a04", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "sha1", "timestamp": "1784344311", "to_ids": true, "type": "sha1", "uuid": "562a4005-ad89-40de-bfb4-95190d945bc9", "value": "ce790253cc0a619f0944b1e70a6c559b110cb8a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "sha256", "timestamp": "1784344311", "to_ids": true, "type": "sha256", "uuid": "36d37564-5d80-4081-9035-4a75a72a1c4e", "value": "938054c6bb7dc737fce16513b2882808f199c2f892f808d439525a1650d49089", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "text", "timestamp": "1784337780", "to_ids": false, "type": "text", "uuid": "3701d9b4-bb38-4029-8ba9-52ca43d9cdd0", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.C!ml\nClamAV: None\nVT Total Detection: 9/74\nFirst Submission: 2024-12-15T23:26:45+00:00\nLast Submission: 2024-12-15T23:26:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "creation-time", "timestamp": "1784337780", "to_ids": false, "type": "datetime", "uuid": "81303a22-57de-491c-aac7-df9c7e7a3975", "value": "2024-03-16T13:39:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "ssdeep", "timestamp": "1784337780", "to_ids": true, "type": "ssdeep", "uuid": "8eaa58b9-23e7-4478-941a-c23f878e552d", "value": "24576:+IRhpDRbC/oJiXq/+/8oXCXXykHa0+F6++AEifSHsb/nBR174gED/D0/ktL8+/jX:mEjP8+voM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337780", "to_ids": false, "type": "size-in-bytes", "uuid": "bdb7ab40-116e-4929-ac62-ab81c8f4de9e", "value": "1219584" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "vhash", "timestamp": "1784337780", "to_ids": true, "type": "vhash", "uuid": "d7e2d305-23a4-42a6-a9b9-941a482bae35", "value": "1160be06551d15551d151az5dnz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-12-15T23:26:45+00:00", "last_seen": "2024-12-15T23:26:45+00:00", "object_relation": "filename", "timestamp": "1784337780", "to_ids": true, "type": "filename", "uuid": "e539f50e-45e5-436e-9fec-95c6690e7ba3", "value": "SimpleDLL_x64.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345226", "uuid": "06ffea1d-4ad1-407c-9900-94a03252cd91", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "md5", "timestamp": "1784345226", "to_ids": true, "type": "md5", "uuid": "c73f2c6a-2777-4576-aa2a-4ed075080b57", "value": "ebf10abb661350779d24d849f828eb0b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "sha1", "timestamp": "1784344312", "to_ids": true, "type": "sha1", "uuid": "97839877-6fab-4607-89a2-fd22e1c30857", "value": "2d1887930758b98b1a09f2f656079599f88a6bf6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "sha256", "timestamp": "1784344313", "to_ids": true, "type": "sha256", "uuid": "7d203499-44bd-40fa-a53b-93ca81fb5a4e", "value": "a2e7989742c6b6436ebb47507881946e4f662080dff71d104eb9a9554f38af7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "text", "timestamp": "1784337801", "to_ids": false, "type": "text", "uuid": "1233f144-4e5d-425b-82d9-e3b9bb63d98e", "value": "Type Description: 7ZIP\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 14/74\nFirst Submission: 2025-08-31T20:05:58+00:00\nLast Submission: 2026-07-14T13:04:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "ssdeep", "timestamp": "1784337801", "to_ids": true, "type": "ssdeep", "uuid": "e869bb89-89e9-46e9-8f15-19a6ff4ad23d", "value": "196608:tt45gWBMp+05tPv0QXkF2GMI0XnS08VcHWr5ZhjBJrMIql:tNoy+00Q0YnI6nSW2r/hjjq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337801", "to_ids": false, "type": "size-in-bytes", "uuid": "61e4966b-be3b-4473-9a09-6cd443b70c8a", "value": "8059214" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "vhash", "timestamp": "1784337801", "to_ids": true, "type": "vhash", "uuid": "faf5b277-3971-468d-b113-e83a2db08b26", "value": "7c742414c4eba17005b7caa0fa71fcfc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-31T20:05:58+00:00", "last_seen": "2026-07-14T13:04:55+00:00", "object_relation": "filename", "timestamp": "1784337801", "to_ids": true, "type": "filename", "uuid": "41bec334-45f8-4f78-b111-12a05fc481f7", "value": "CS2External.7z" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345247", "uuid": "fb6fc5d8-4538-4d24-8090-023d3a5b1240", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "md5", "timestamp": "1784345247", "to_ids": true, "type": "md5", "uuid": "876585ec-a3e1-4634-a86b-d78b4c4c8051", "value": "cba1927cf6959dc99ecbd0c553e4db6f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "sha1", "timestamp": "1784344314", "to_ids": true, "type": "sha1", "uuid": "d9e10047-285d-478d-96f8-314b5d0cca51", "value": "7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "sha256", "timestamp": "1784344314", "to_ids": true, "type": "sha256", "uuid": "d73d507d-53b3-44de-a9a8-5f8babd79eae", "value": "d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "text", "timestamp": "1784337823", "to_ids": false, "type": "text", "uuid": "2525dd3f-7fe7-43e7-82f3-fe5ae2eb331a", "value": "Type Description: DOS batch file\nMicrosoft: None\nClamAV: None\nVT Total Detection: 4/74\nFirst Seen In The Wild: 2023-06-03T04:22:00+00:00\nFirst Submission: 2023-04-16T23:59:52+00:00\nLast Submission: 2026-07-16T00:12:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "ssdeep", "timestamp": "1784337823", "to_ids": true, "type": "ssdeep", "uuid": "4bd0213c-aeb8-4449-a9a9-865aca02ba2b", "value": "3:mKDD3M/PKXD0dAyIgydsJnn:h7dXD0frZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337823", "to_ids": false, "type": "size-in-bytes", "uuid": "b15869e6-a4aa-4a78-a071-ee86a4e40268", "value": "60" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-16T23:59:52+00:00", "last_seen": "2026-07-16T00:12:21+00:00", "object_relation": "filename", "timestamp": "1784337823", "to_ids": true, "type": "filename", "uuid": "d1371ff3-4606-482c-971f-8a151118cd2f", "value": "benchmark_1M.cmd" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345268", "uuid": "bcdda1bd-3170-4798-a0c0-658e859bfc49", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "md5", "timestamp": "1784345268", "to_ids": true, "type": "md5", "uuid": "ac8a6e23-afe9-4825-80c5-ea052a65d991", "value": "0100dad675575734961f4c7bd2da5628", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "sha1", "timestamp": "1784344315", "to_ids": true, "type": "sha1", "uuid": "59d2fa21-8c10-452a-a720-7fe1b55a8217", "value": "bdb724fd56c159dc529b4e9d8a3a85727c244b4a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "sha256", "timestamp": "1784344315", "to_ids": true, "type": "sha256", "uuid": "6720782e-7871-442d-9ebe-4489710c19c1", "value": "d95bba20f04687b0b821d4fc0a17137db8b9eda5fe3fb34da319abefc45fe0d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "text", "timestamp": "1784337845", "to_ids": false, "type": "text", "uuid": "1b336733-5a56-48dc-b452-c039a8aedf3e", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 09:02 AM 02/26/2024\nSigners: win.rar GmbH; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2023-05-14T21:15:33+00:00\nFirst Submission: 2024-02-28T08:49:54+00:00\nLast Submission: 2026-07-08T15:28:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "creation-time", "timestamp": "1784337845", "to_ids": false, "type": "datetime", "uuid": "cb1f6adb-63ef-4cb0-8ad5-e42a77c6d2a9", "value": "2024-02-26T09:00:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "ssdeep", "timestamp": "1784337845", "to_ids": true, "type": "ssdeep", "uuid": "f7d2d62b-9e7c-4103-b11c-722c8eb624c3", "value": "12288:7CBxnI3qqufh9l3r+ruV9NkhiN4htiSp6U:713OgINkhiN4iSpR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337845", "to_ids": false, "type": "size-in-bytes", "uuid": "5b6f1487-57cd-49f4-9bb0-97a5d282a626", "value": "506008" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "vhash", "timestamp": "1784337845", "to_ids": true, "type": "vhash", "uuid": "d1660c11-8d08-49cf-89c3-6576e036d413", "value": "055076655d5555151550a8z7e7z2035z33z9fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-02-28T08:49:54+00:00", "last_seen": "2026-07-08T15:28:20+00:00", "object_relation": "filename", "timestamp": "1784337845", "to_ids": true, "type": "filename", "uuid": "0c090f98-288e-4f97-8c08-c8f6cc04cefe", "value": "Command line RAR" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345289", "uuid": "803373f5-a471-4d93-a949-2da4f4060045", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "md5", "timestamp": "1784345289", "to_ids": true, "type": "md5", "uuid": "25684b9e-a97e-4f2d-bc08-c4099aa2cbc3", "value": "2e737f5c3af9c8aa5216dfdc5be02cc6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "sha1", "timestamp": "1784344316", "to_ids": true, "type": "sha1", "uuid": "66bf24a6-ffcf-4fbb-9b2d-01a1c5342ab4", "value": "05fe2040aea6f6cff25deaf5ca2ca6793faa64c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "sha256", "timestamp": "1784344317", "to_ids": true, "type": "sha256", "uuid": "039efbf3-6ab2-47f1-afbd-0ff5a001ce9a", "value": "e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "text", "timestamp": "1784337868", "to_ids": false, "type": "text", "uuid": "418b2526-fd31-461e-a1a5-0773fa5cf398", "value": "Type Description: DOS batch file\nMicrosoft: None\nClamAV: None\nVT Total Detection: 17/74\nFirst Seen In The Wild: 2023-09-28T17:49:37+00:00\nFirst Submission: 2023-06-03T18:49:47+00:00\nLast Submission: 2026-06-30T02:58:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "ssdeep", "timestamp": "1784337868", "to_ids": true, "type": "ssdeep", "uuid": "714430d8-1ed1-4418-86c7-36c97d98eb48", "value": "24:knECAL1ACWm4Vw5fP5t59XMaoGaK8IZAR0x+FcU71Mtzkz7CQhvvFIVV+XD/Ve:8ErG58pPS5GapIWG+Fcc1Vz7LhvvMVwM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337868", "to_ids": false, "type": "size-in-bytes", "uuid": "f75e481d-a393-4ab0-8aac-27f3c52195f4", "value": "1023" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-03T18:49:47+00:00", "last_seen": "2026-06-30T02:58:42+00:00", "object_relation": "filename", "timestamp": "1784337868", "to_ids": true, "type": "filename", "uuid": "7c930125-8023-4cc5-b2a2-36a979558a7e", "value": "pool_mine_example.cmd" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784345310", "uuid": "c5716ce1-7aa8-47dd-870b-18ca4917c929", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "md5", "timestamp": "1784345310", "to_ids": true, "type": "md5", "uuid": "6a5eba2f-ed1f-4600-83af-140d947341b8", "value": "18cd4a34ca3111b58afd6b45d4c92817", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "sha1", "timestamp": "1784344318", "to_ids": true, "type": "sha1", "uuid": "a98543e0-3e46-4a40-9c1e-25132b7ffad7", "value": "c1e73bf677aa8cec0cf2d11e196cceed24235a31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "sha256", "timestamp": "1784344319", "to_ids": true, "type": "sha256", "uuid": "c4f45a70-3496-4b6f-a98d-6a48782ec4c0", "value": "f245956c930f220f0bedf355a751a5cd738b4ec6bb6c5d584199ab3fa6c0a1c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "text", "timestamp": "1784337890", "to_ids": false, "type": "text", "uuid": "c927f35a-5719-434f-9848-d54a672ddc47", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2021-09-14T01:49:18+00:00\nFirst Submission: 2021-09-17T18:46:00+00:00\nLast Submission: 2026-07-14T19:57:53+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "creation-time", "timestamp": "1784337890", "to_ids": false, "type": "datetime", "uuid": "f20d7f20-66c1-4936-bb61-31a93c0e19d8", "value": "2021-09-14T00:49:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "ssdeep", "timestamp": "1784337890", "to_ids": true, "type": "ssdeep", "uuid": "96c2f903-825a-4354-a0b2-833257b1fbac", "value": "24576:p57RBAzPkZ4ITfWJWhQJS8Q2wZua8iU29CmSBsrKbVT32s7NTTx6sO8C5ZuG:DgZxJaK5wZnq2sma2sxTTdRC5b" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784337890", "to_ids": false, "type": "size-in-bytes", "uuid": "72692808-b6e9-4ece-9d61-83df2a25e45b", "value": "1174178" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "vhash", "timestamp": "1784337890", "to_ids": true, "type": "vhash", "uuid": "57ff1c18-6dea-4bff-94e7-d77274b7731e", "value": "0160876d15655c0d5d1dbz2771lz2fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2021-09-17T18:46:00+00:00", "last_seen": "2026-07-14T19:57:53+00:00", "object_relation": "filename", "timestamp": "1784337890", "to_ids": true, "type": "filename", "uuid": "3efa86fc-c981-4b77-94c5-53760c7a35cc", "value": "windres.exe" } ] } ] } }