{ "Event": { "analysis": "1", "date": "2026-05-22", "extends_uuid": "", "info": "[Threat Intel] Tracking Iranian APT Screening Serpens\u2019 2026 Espionage Campaigns", "protected": false, "publish_timestamp": "1780293095", "published": true, "threat_level_id": "2", "timestamp": "1780293095", "uuid": "cbfd6ef2-719f-4544-af73-580b5f764c5c", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0afe32", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#1b0fe1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#26fab6", "local": false, "name": "misp-galaxy:target-information=\"Israel\"", "relationship_type": "" }, { "colour": "#a24b57", "local": false, "name": "misp-galaxy:target-information=\"United Arab Emirates\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UNC1549\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#1c006d", "local": false, "name": "rectifyq:topic=\"geopolitical\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1779706823", "to_ids": false, "type": "link", "uuid": "e8ea4192-e5dd-4960-816c-0bb6f83b942a", "value": "https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1779706823", "to_ids": false, "type": "text", "uuid": "93baea33-3806-44a1-a233-86b2aa59a1dd", "value": "Unit 42 researchers identified six new remote access Trojan variants deployed by Iran-nexus APT group Screening Serpens between February and April 2026, coinciding with a regional conflict starting February 28, 2026. The group targeted entities in the U.S., Israel, UAE, and other Middle Eastern locations, primarily focusing on technology sector professionals through highly tailored social engineering using personalized recruitment lures. Two new malware families, MiniUpdate and MiniJunk V2, were discovered featuring advanced techniques including AppDomainManager hijacking that manipulates .NET application initialization to disable security mechanisms. The campaigns demonstrated increased technical capabilities and operational resilience, with each variant using dedicated C2 infrastructure hosted on Azure. The attacks leveraged DLL sideloading, scheduled tasks for persistence, and sophisticated evasion techniques to maintain long-term access for espionage purposes." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1779706823", "to_ids": false, "type": "text", "uuid": "934617f6-5ff5-47b2-93f4-3041fee4e39b", "value": "Name: Tracking Iranian APT Screening Serpens\u2019 2026 Espionage Campaigns\nAuthor: AlienVault\nAdversary: Screening Serpens\nTags: [\"minijunk v2\", \"screening serpens\", \"appdomainmanager hijacking\", \"iran nexus\"]\nTgtd countries: [\"United States of America\", \"Israel\", \"United Arab Emirates\"]\nMlwr families: [\"MiniUpdate\", \"MiniJunk V2\", \"UpdateChecker.dll\", \"uevmonitor.dll\"]\nAttack_ids: [\"T1053.005\", \"T1036.005\", \"T1204.002\", \"T1566.001\", \"T1082\", \"T1106\", \"T1140\", \"T1055\", \"T1218\", \"T1083\", \"T1036.004\", \"T1057\", \"T1041\", \"T1547.001\", \"T1562.001\", \"T1027\", \"T1059.003\", \"T1070.004\", \"T1071.001\", \"T1574.002\"]\nIndustries: [\"Technology\", \"Aerospace\", \"Defense\", \"Telecommunications\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1780196839", "to_ids": false, "type": "threat-actor", "uuid": "28dafa77-ff26-44a7-8341-01a805d9011c", "value": "Screening Serpens", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Bohrium\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UNC1549\"", "relationship_type": "" }, { "colour": "#0afe32", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289549", "to_ids": true, "type": "domain", "uuid": "6a3b93f3-0786-4dd4-9c6c-b4064edb19e8", "value": "business-startup.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:01/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780287736", "to_ids": true, "type": "md5", "uuid": "356aae62-bb43-47e3-84eb-c523bc2ab22c", "value": "edcdba624ddb43c2a1dcf334aa493068", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289570", "to_ids": true, "type": "hostname", "uuid": "fc014a31-4af9-4b8d-9ed4-024081b9c14e", "value": "licencemanagers.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289592", "to_ids": true, "type": "hostname", "uuid": "e90feb9f-8b5a-4c2b-bef6-1f767a7f28e7", "value": "licencesupporting.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289613", "to_ids": true, "type": "hostname", "uuid": "19d97482-cd89-4e2b-80f3-ac0f6c8755c4", "value": "peerdistsvcmanagers.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289634", "to_ids": true, "type": "hostname", "uuid": "98c19f7f-d2ff-4bfb-ab10-b7350a877087", "value": "themesmanagers.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289655", "to_ids": true, "type": "hostname", "uuid": "84419861-380c-4632-a746-35aa59bffaac", "value": "themesprovidermanagers.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289676", "to_ids": true, "type": "hostname", "uuid": "6ff465ab-3e53-495e-9c69-c1597aa9492e", "value": "docspace-y4cumb.onlyoffice.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289697", "to_ids": true, "type": "hostname", "uuid": "1b755f10-80f9-4eb0-aeef-117fe9f1bf4c", "value": "nanomatrix.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289719", "to_ids": true, "type": "hostname", "uuid": "6f4dda16-285d-43ff-a2ee-e803ce0cd4c2", "value": "quantumweave.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289740", "to_ids": true, "type": "hostname", "uuid": "7cc51e67-e1cd-4e21-9b82-2cb76ff0b9cb", "value": "elementshift.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289761", "to_ids": true, "type": "hostname", "uuid": "c19b092b-a4ab-46dc-92fd-b7a9d41184ae", "value": "business-startup.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289782", "to_ids": true, "type": "hostname", "uuid": "c12e98fc-ef87-4a26-ba81-7ac53ba6a953", "value": "businessstartup.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289803", "to_ids": true, "type": "hostname", "uuid": "0c82fc5f-1630-4e47-8d1f-f52298d2ffba", "value": "buisness-centeral.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289825", "to_ids": true, "type": "hostname", "uuid": "5ffee522-a94f-4d29-835a-9dc22de57a36", "value": "buisness-centeral-transportation.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289846", "to_ids": true, "type": "domain", "uuid": "3ce2e543-0ede-432c-a32e-602fc20d5d68", "value": "buisness-centeral-transportation.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289867", "to_ids": true, "type": "hostname", "uuid": "00750cce-28d7-4194-9c7f-6e643d22213b", "value": "docspace-twpf0e.onlyoffice.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289888", "to_ids": true, "type": "domain", "uuid": "32dccb90-47d0-4f41-8a7e-9191960d07eb", "value": "premierhealthadvisory.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289909", "to_ids": true, "type": "hostname", "uuid": "cff1abce-65dd-4464-920e-b763992a65d7", "value": "premierhealthadvisory.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289930", "to_ids": true, "type": "hostname", "uuid": "60eed88f-aa91-4a15-98b5-8b16ffbf6121", "value": "premier-healthadvisory.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289951", "to_ids": true, "type": "domain", "uuid": "d6f96ae3-bdb6-4d58-9bd0-5098c2694a55", "value": "ramiltonsfinance.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289973", "to_ids": true, "type": "hostname", "uuid": "4d3d7d6b-e46e-45cd-b16a-4f2174d28a68", "value": "ramiltons-finance.azurewebsites.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780289994", "to_ids": true, "type": "url", "uuid": "a9cdba58-fb36-4622-8f18-21bb33ec744a", "value": "https://docspace-y4cumb.onlyoffice.com/storage/files/root/folder_3602000/file_3601577/v1/content.zip[...]", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780290014", "to_ids": true, "type": "url", "uuid": "3d66f3b1-3fd8-48af-b9af-a2962dce0271", "value": "https://app[redacted].live/meeting/edcdba624ddb43c2a1dcf334aa493068", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780290035", "to_ids": true, "type": "url", "uuid": "70284f8a-c993-4432-95b1-63ed05728d74", "value": "https://docspace-twpf0e.onlyoffice.com/storage/files/root/folder_3765000/file_3764519/v1/content.zip?filename=remote.[REDACTED].zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780290056", "to_ids": true, "type": "url", "uuid": "cdd1f2de-0dc6-4527-ad55-ea4b9bf5d510", "value": "https://2117.filemail.com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290077", "uuid": "a81860d4-5e85-4419-8e20-357e641897ca", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290077", "to_ids": true, "type": "md5", "uuid": "16204afc-84df-4198-8189-c0936ab925c0", "value": "628d831989787ee1b4ffee611cb2014b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287726", "to_ids": true, "type": "sha1", "uuid": "e3555ead-73b0-4318-bd7c-91864c582cbf", "value": "67f41dc48bfd0c0597295259bd3c0d3c09dfea34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287726", "to_ids": true, "type": "sha256", "uuid": "74e2a533-1c96-4bc0-82c6-6c32bb192ff1", "value": "332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285426", "to_ids": true, "type": "ssdeep", "uuid": "4c6f05c1-a10b-4d7f-8749-573763dd2208", "value": "3072:kaM9Uj1PYqQP99nNToR3FICHKZ2jvW4mEFwreTsF1veQgcsPb6+CY5yAZUiT:kaM9ud2nN61Zq29FseYF1JgcFjY5yAeW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285426", "to_ids": false, "type": "size-in-bytes", "uuid": "c08f75c3-db24-4714-9a3d-f1a5c6b661ba", "value": "166655" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285426", "to_ids": true, "type": "vhash", "uuid": "4b106d36-221a-42f1-9214-614655f4f890", "value": "a180547f1880edc6f59363a3a8e90d22" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285426", "to_ids": true, "type": "filename", "uuid": "a6578bf3-38ed-4e1b-b4bc-a4b1f300cfcc", "value": "Hiring Portal.zip" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 27/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285426", "to_ids": false, "type": "text", "uuid": "bf5c8ad9-0eeb-4caa-bae2-fa6670a372e6", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:44/68\nFirst Submission:2026-03-28T15:07:10.000000+00:00\nLast Submission:2026-03-28T15:07:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290099", "uuid": "bd6498c1-fc6a-4923-9290-2a01951a424f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290099", "to_ids": true, "type": "md5", "uuid": "aa93b85b-6ea5-4504-a659-69ad22ee9303", "value": "810f8e3b88eb05f710c09552941d6f56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287726", "to_ids": true, "type": "sha1", "uuid": "ccde8ed3-85b5-419e-a5b3-8a5dbbf1d9a4", "value": "da11679653ef33952c3dc8d8850e43d7b8ac884a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287727", "to_ids": true, "type": "sha256", "uuid": "794f0c49-2a8c-41bd-8352-11bde2773103", "value": "0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285447", "to_ids": true, "type": "ssdeep", "uuid": "32721802-5278-4119-b53d-f21dcae8b5e7", "value": "3072:KVf+efWuHM+cgWGcdNramrLJ4gCJXRz3xGxg8O6K9cO+bWqrY:K/WuvpWGcvZqgyXxhVPRsD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285447", "to_ids": false, "type": "size-in-bytes", "uuid": "21663fd0-4321-4cf3-a986-c8414d9448c6", "value": "251392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285447", "to_ids": true, "type": "vhash", "uuid": "922d3fa5-6854-48dc-bcd9-d290609f616f", "value": "125066655d155d055az49nz1ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285447", "to_ids": true, "type": "filename", "uuid": "c88c66d1-649f-4802-a92c-10d32d2c71b9", "value": "UpdateChecker.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 29/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285447", "to_ids": false, "type": "text", "uuid": "29a29d19-a94c-4b4e-a6d3-d16f46925656", "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:39/71\nFirst Submission:2026-03-28T15:07:29.000000+00:00\nLast Submission:2026-05-28T13:43:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290120", "uuid": "9b1c0213-e14d-4741-879f-a594e3e99739", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290120", "to_ids": true, "type": "md5", "uuid": "a21eb0f8-4fba-4798-8736-ebd6d2f6d91b", "value": "cdbe76cdfdec8f7c09781b2ef0fdb7f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287727", "to_ids": true, "type": "sha1", "uuid": "6f2e8272-63e5-4a70-a307-bb504ec7852c", "value": "0997b6c2fdc3af2de118db559c92ef510c60a994", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287727", "to_ids": true, "type": "sha256", "uuid": "35f781b4-772e-4b95-b8b8-4f1fab58bcd3", "value": "b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285470", "to_ids": true, "type": "ssdeep", "uuid": "aac65ed3-6a0e-4b76-b3c5-c366b03d6312", "value": "98304:pt13ZYs3nmAtz64qBn1NklhsBrJrQbR/ke:rZnmAnlahJrQbRk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285470", "to_ids": false, "type": "size-in-bytes", "uuid": "292f3bd2-cd25-4157-9507-acca5cdcc7f6", "value": "12463104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285470", "to_ids": true, "type": "vhash", "uuid": "31759478-e2a3-46d7-a7df-20465fc823e5", "value": "117066655d755d055az5c&za40" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285470", "to_ids": true, "type": "filename", "uuid": "97b9326f-c504-42dd-9ae2-06cd950389e2", "value": "payload_uevmonitor.decrypted" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 28/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285470", "to_ids": false, "type": "text", "uuid": "e64472e8-91f6-4b96-87d9-844c89dffcbc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Tedy!MTB\nVT Total Detection:45/71\nFirst Submission:2026-02-17T08:46:29.000000+00:00\nLast Submission:2026-05-21T09:17:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290141", "uuid": "10814108-a16e-4b29-b539-3bc0a828955c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290141", "to_ids": true, "type": "md5", "uuid": "37798edb-aedb-4552-9ed5-2faf211c3969", "value": "b4576f866d9e9fd80f0db609811760e8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287728", "to_ids": true, "type": "sha1", "uuid": "2b3beb27-4e05-4b26-9d7a-d78e1b3f3643", "value": "58c83b743101ed77aea7fda7e3516903eaeda12d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287728", "to_ids": true, "type": "sha256", "uuid": "a30cb897-bcfc-47a2-88a4-95afa9a5b008", "value": "38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285512", "to_ids": true, "type": "ssdeep", "uuid": "16c5ec36-aab9-4731-a124-a47c4c6bdc60", "value": "6144:VxjqaYb8zqo/plKOhQGXlPu0ergmuVnI6n6D1VjJiCfFjY5yAeig:Vx12EplKOs0nvnIbjjjfByyeg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285512", "to_ids": false, "type": "size-in-bytes", "uuid": "ff2945c9-1049-4d86-98d6-96ba381719df", "value": "282530" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285512", "to_ids": true, "type": "vhash", "uuid": "097e7772-7c16-4032-9c94-02892a661556", "value": "a180547f1880edc6f59363a3a8e90d22" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285512", "to_ids": true, "type": "filename", "uuid": "9955ebc3-e9f1-4b7d-891f-41c3c8578442", "value": "ZoomInstall64 (2).zip" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 28/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285512", "to_ids": false, "type": "text", "uuid": "7921ed57-6e9c-4262-8b4c-aa9527b96238", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:42/68\nFirst Submission:2026-03-26T12:31:23.000000+00:00\nLast Submission:2026-03-26T12:31:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290162", "uuid": "9d54bc35-27fb-48ac-a69e-2bb5f5d2c8a1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290162", "to_ids": true, "type": "md5", "uuid": "b5350d50-19e5-4a3b-a174-614ef1ad0f66", "value": "34af888f33898a4c3b93ac0e8fecf3a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287729", "to_ids": true, "type": "sha1", "uuid": "e742a05c-23cc-4216-851f-4a34d9477b75", "value": "f2049d64631264ed6c8ccabdd486763341e18163", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287729", "to_ids": true, "type": "sha256", "uuid": "69979777-cf77-4401-a557-54a2b81ebaeb", "value": "43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285534", "to_ids": true, "type": "ssdeep", "uuid": "6337230e-d4e7-46e2-baac-45200276ec76", "value": "24576:A5TqAtC9p+h3mR1IWSkr1iIzb0FXFqKrH:A5TptWq3mRhhr1iI/0bq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285534", "to_ids": false, "type": "size-in-bytes", "uuid": "a4df9424-22db-492c-805d-142d89de33ef", "value": "2355712" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285534", "to_ids": true, "type": "vhash", "uuid": "b96b0baf-ec1a-475d-91a7-81493d092d77", "value": "126076655d155d05555az5b&za40" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285534", "to_ids": true, "type": "filename", "uuid": "37ee8b44-2156-4b0f-a5d4-983477e7cfba", "value": "43d.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 29/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285534", "to_ids": false, "type": "text", "uuid": "6f7e2c83-ee20-43cf-a521-e546537c220d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLHijack.DSK5!MTB\nVT Total Detection:39/71\nFirst Submission:2026-03-27T19:41:38.000000+00:00\nLast Submission:2026-05-28T09:46:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290183", "uuid": "ae980b73-e990-482b-9837-766d122e023d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290183", "to_ids": true, "type": "md5", "uuid": "8f05a0c5-4405-4ea1-b9c8-9f05b22641a5", "value": "756d53fb230a482568d46da68548227c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287730", "to_ids": true, "type": "sha1", "uuid": "eb59c027-3953-435a-b977-196e4b05e860", "value": "3b2926400541e017a043926ebf92dd91ee80d797", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287730", "to_ids": true, "type": "sha256", "uuid": "72633462-c9a7-4671-862c-5ab3e612f8a3", "value": "44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285556", "to_ids": true, "type": "ssdeep", "uuid": "74da723b-27c4-4c56-8cce-fecb5dfa9a99", "value": "24576:lNaT1f50R+nVWMH1iQnk2tC6set1QovnGsGSSKNLl8X5WqIg6238S69RIULDRSFm:LaT3a+kk1ptyovGsG5KL8cqITIk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285556", "to_ids": false, "type": "size-in-bytes", "uuid": "a70f7ec6-3213-4053-ad16-77a61d61b66b", "value": "1494475" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285556", "to_ids": true, "type": "vhash", "uuid": "19ad91af-962e-46ea-bc43-56379bbf47e0", "value": "3cd990bb3b15831b074569eab4179de1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285556", "to_ids": true, "type": "filename", "uuid": "83b15777-b029-4ab7-8713-f1b99661d904", "value": "United Airlines (2).zip" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 29/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285556", "to_ids": false, "type": "text", "uuid": "2afd6f8f-5ff5-4a93-a328-da16ab0121dd", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:38/66\nFirst Submission:2026-03-28T15:08:54.000000+00:00\nLast Submission:2026-03-28T15:08:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290204", "uuid": "dbb37adf-cba6-4b4a-a859-3fc3af07978d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290204", "to_ids": true, "type": "md5", "uuid": "7372918c-93a9-416b-ace5-53ca100b38c3", "value": "43255fdfb3ec22a65779d3d85f07aa3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287731", "to_ids": true, "type": "sha1", "uuid": "d2712db8-e767-4e32-a48b-289ddb7b6a8e", "value": "b07bbb006ddfcf5cc216937752b8a67e288a1ca1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287731", "to_ids": true, "type": "sha256", "uuid": "1395dfef-ee12-4e3a-9b98-8aac4263600e", "value": "74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285577", "to_ids": true, "type": "ssdeep", "uuid": "3fa22233-c3b7-4406-8d9c-224f1443d567", "value": "3072:Bs7NVSyU8s5IxkRBdxsQu2GZ/doHNDiXfSdTLfuv+Z3a28FwYaSsPb6+CY5yAZUb:BcN1Fs5Is/xu2GVqtDiXfMLfuC3aFF1z" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285577", "to_ids": false, "type": "size-in-bytes", "uuid": "16283b52-ea28-4781-95f4-943c1e936bf7", "value": "192072" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285577", "to_ids": true, "type": "vhash", "uuid": "c0db2f3b-3b6a-40fb-8686-37988098cba4", "value": "a180547f1880edc6f59363a3a8e90d22" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285577", "to_ids": true, "type": "filename", "uuid": "812e3179-d17d-43eb-bc8d-aa6b32fa72fc", "value": "remote.unitedairlines.zip" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 27/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285577", "to_ids": false, "type": "text", "uuid": "f0152e9c-3d87-40a3-8f1a-6379f5677a23", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:36/68\nFirst Submission:2026-04-17T13:06:29.000000+00:00\nLast Submission:2026-04-17T13:07:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290225", "uuid": "51e200f6-533a-4559-ae83-f8ba7267a953", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290225", "to_ids": true, "type": "md5", "uuid": "53633c1a-492a-4618-bbad-bdaa7bb8842a", "value": "1004a0df8dd34741b40ed6bc3c04ade5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287732", "to_ids": true, "type": "sha1", "uuid": "797c88c8-7317-4ac3-ae3d-fc6220f7b385", "value": "25c14e19526be586b75b52cae8bdb1553c746642", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287732", "to_ids": true, "type": "sha256", "uuid": "c93d471e-91c4-4f9b-b9ab-d42a07994a73", "value": "8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285599", "to_ids": true, "type": "ssdeep", "uuid": "249b36ee-45d4-4bd9-8aad-07beee71be2f", "value": "24576:/HhTDVYxwRr7ilzyodjvjF9n1WRemesUYZY5Ci9VDjiysMlcoA0d:/H1JswRrEzHfcOsBS5n9AnUA0d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285599", "to_ids": false, "type": "size-in-bytes", "uuid": "d53c7fb0-43d8-4224-a7a5-c74a03f7b77d", "value": "1239584" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285599", "to_ids": true, "type": "vhash", "uuid": "a3a4fde1-d148-4067-a1a2-9d1a93cdaefa", "value": "9c2cae4bfc7e8fbe0a7647323dbf0d1c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285599", "to_ids": true, "type": "filename", "uuid": "ae650c00-004f-4da6-8a5e-8970d47989ad", "value": "8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b.zip" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 28/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285599", "to_ids": false, "type": "text", "uuid": "6a2c2530-33d1-47ac-9847-4a08ff1a3487", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:35/68\nFirst Submission:2026-03-27T19:38:16.000000+00:00\nLast Submission:2026-04-13T16:51:41.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290246", "uuid": "284ffc48-bd19-448c-abb8-fae75365801f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290246", "to_ids": true, "type": "md5", "uuid": "c0c1a5b6-8bf8-4c9e-a7df-4160cf841fa9", "value": "3106848925a39b9d51f9ad9f5963e417", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287732", "to_ids": true, "type": "sha1", "uuid": "0eba9430-cc1c-4d57-8af5-3472a28008d4", "value": "be3b4a74f3872008c4cde0cbe8624e2c15618eaf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287732", "to_ids": true, "type": "sha256", "uuid": "0db4efba-64b2-4d8d-b5b4-a97359f50f14", "value": "9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285621", "to_ids": true, "type": "ssdeep", "uuid": "1e6d07a0-b7f1-4d25-8b34-9a7271512a96", "value": "393216:G3mXVjgkmu6op6vrgx+Ypaef+DD1mwh6ZxrtHl7oHYbI3llCf9jiXiVLx/0kSwr8:2kRtAkiegDEwhGLx/HS6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285621", "to_ids": false, "type": "size-in-bytes", "uuid": "189350fb-bd5a-4c0b-affe-614a06c466e9", "value": "16976896" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285621", "to_ids": true, "type": "vhash", "uuid": "ccab99c7-9544-44c9-9be4-29870fd24341", "value": "117026751\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285621", "to_ids": true, "type": "filename", "uuid": "c3dadc9a-e373-454c-ba34-7cd112c4bc78", "value": "uevmonitor.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 30/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285621", "to_ids": false, "type": "text", "uuid": "80f164c2-ba35-4bc8-aa3b-4390279d8f99", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:MSIL/Astraea.GDM!MTB\nVT Total Detection:41/71\nFirst Submission:2026-02-17T08:37:52.000000+00:00\nLast Submission:2026-05-29T19:12:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290268", "uuid": "6de383fb-393e-4a7e-b503-a2e6d50c0545", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290268", "to_ids": true, "type": "md5", "uuid": "08565e4e-0127-4db1-9d52-33a50c83ee82", "value": "16b421555b84b87e82a56813e86dbf80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287733", "to_ids": true, "type": "sha1", "uuid": "9ca5827e-a813-4320-a48b-d46d80e26b35", "value": "4b35cda868585a0e593f6d316b17633b1fd42f1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287733", "to_ids": true, "type": "sha256", "uuid": "4b5d8499-7f5d-45f6-b2d3-6986b2d430f2", "value": "9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285643", "to_ids": true, "type": "ssdeep", "uuid": "bd2b7340-feb0-4dfd-84ef-0ba21a72e720", "value": "12288:h2xa78EpMeFZ98GM7HXDmvM9kpkZ9hkvJerb8:Ph+zbXsM2p+h+1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285643", "to_ids": false, "type": "size-in-bytes", "uuid": "bbb7177d-7c73-426b-8eec-4449ef76053f", "value": "832000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285643", "to_ids": true, "type": "vhash", "uuid": "33e3b42a-3eb6-4f66-a2fc-5a5544c42847", "value": "185076655d155d055551z13z60051mz1acza40" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285643", "to_ids": true, "type": "filename", "uuid": "2e266b07-4afa-4cae-b821-040e122e49ba", "value": "unbcl.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 28/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285643", "to_ids": false, "type": "text", "uuid": "75613624-8196-4f31-b9a5-75bf34508bdc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Vigorf.A\nVT Total Detection:37/71\nFirst Submission:2026-03-27T19:41:38.000000+00:00\nLast Submission:2026-05-27T14:14:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290289", "uuid": "72616969-6609-44bb-8a1b-b6bc1de7eee9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290289", "to_ids": true, "type": "md5", "uuid": "eaba2ec3-fadf-4f4d-abbd-2a74b0471918", "value": "a4ee413a4df76a2b58e3ad31c9099f21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287734", "to_ids": true, "type": "sha1", "uuid": "6dc448e5-37fc-4bfa-9daa-cef88b6e42d9", "value": "67d635eff6a477efb34de9150c1c2c8b2139e114", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287734", "to_ids": true, "type": "sha256", "uuid": "25d682b8-c923-4824-8a76-68f14317315f", "value": "bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285665", "to_ids": true, "type": "ssdeep", "uuid": "a05ff4af-4202-429c-a4f4-95f423d57f47", "value": "3072:LDGN47q3MVohWaFI8qMJf9xmb8nIeJRPngO6698E/4zWkp45pZluBOt1xT:57qoqWaFI8dxmonIeDlf8EEpejh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285665", "to_ids": false, "type": "size-in-bytes", "uuid": "5caf873c-9c12-4e0a-8f44-5ab07576b00f", "value": "269824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285665", "to_ids": true, "type": "vhash", "uuid": "202453ed-96d3-4d00-b031-68eee7f1ef62", "value": "125066655d155d055az51nz1ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285665", "to_ids": true, "type": "filename", "uuid": "eea878dd-d5f6-4b72-86f6-79a47678847a", "value": "UpdateChecker.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 28/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285665", "to_ids": false, "type": "text", "uuid": "ed7fa89e-fba3-47df-ae3e-cbcc3c3cfd7d", "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:42/71\nFirst Submission:2026-04-15T10:29:43.000000+00:00\nLast Submission:2026-05-27T11:47:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780290310", "uuid": "48cc9bf6-5d4b-4eb2-92f8-f720d0920080", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780290310", "to_ids": true, "type": "md5", "uuid": "e9dc0b88-75cd-456c-a3bb-165735f6e296", "value": "51c5bc129f86c5aa9c6adc500998c370", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287735", "to_ids": true, "type": "sha1", "uuid": "4b7d255e-2ec4-4d79-bad4-6843eb503cca", "value": "62158039d0998363748942aae3169ccc0f67a641", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287735", "to_ids": true, "type": "sha256", "uuid": "a4432930-ea73-4313-9abf-beb075a3f727", "value": "d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780285687", "to_ids": true, "type": "ssdeep", "uuid": "b651fb6e-d011-4f1a-8cde-44470cede299", "value": "3072:eVf+eCWuHM+cgWGcdNranemHdwLJXJz3xaxgEO0hFAJy6UxLCAGlAJ:eiWuvpWGcvYvwNX5hxX09CeJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780285687", "to_ids": false, "type": "size-in-bytes", "uuid": "57c822f0-34dd-40c0-bf9d-a3073e9e3fc5", "value": "259456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780285687", "to_ids": true, "type": "vhash", "uuid": "6063aef1-a4cb-4b63-a551-968763a03edb", "value": "125066655d155d055az49nz1ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780285687", "to_ids": true, "type": "filename", "uuid": "e93a5916-5de5-43ec-9b73-d6827706b682", "value": "UpdateChecker.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 28/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780285687", "to_ids": false, "type": "text", "uuid": "3403e786-e82b-4639-9175-8968fd33ed35", "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:Win64/SeaMonkey.A!dha\nVT Total Detection:35/71\nFirst Submission:2026-03-26T12:32:44.000000+00:00\nLast Submission:2026-05-27T12:42:44.000000+00:00" } ] } ] } }