{
  "Event": {
    "analysis": "1",
    "date": "2026-06-16",
    "extends_uuid": "",
    "info": "[Threat Intel] Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack",
    "protected": false,
    "publish_timestamp": "1782253830",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782253830",
    "uuid": "ce6915b2-f7f6-4148-96ff-9f03338de345",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#8f20d0",
        "local": false,
        "name": "misp-galaxy:producer=\"Huntress\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#f8140a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7eb739",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Msiexec - T1218.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#041edc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#5affe5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Remote Management - T1021.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c84641",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#3500ca",
        "local": false,
        "name": "rectifyq:detection-rules=\"yara-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665212",
        "to_ids": false,
        "type": "link",
        "uuid": "14c4478c-8ecc-4729-befb-d8010b5f29a7",
        "value": "https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665212",
        "to_ids": false,
        "type": "text",
        "uuid": "8798f847-94e0-4946-8001-ffa9530f02eb",
        "value": "A ClickFix social engineering attack on an unmonitored endpoint led to a multi-stage intrusion affecting over 11 hosts. The infection chain began with a malicious HTA payload that silently installed an MSI package containing Potemkin, a custom loader with a deterministic DGA. Potemkin delivered RMMProject, a 4.4 MB Lua-scriptable RAT featuring browser credential theft with Chrome App-Bound Encryption bypass, hidden-desktop remote control, and 15 distinct task types. The attacker deployed EtherRAT, a Node.js backdoor resolving C2 addresses from Ethereum blockchain, and established a Cloudflare tunnel for persistent access. Hands-on-keyboard activity included battling Windows Defender through AMSI patches, registry modifications, and service termination, followed by lateral movement via WMIExec and SMBExec to deploy malware across the network and reach the domain controller."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665212",
        "to_ids": false,
        "type": "text",
        "uuid": "5109b7b1-c43e-4b44-b01c-45c80e3c83d9",
        "value": "Name: Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack\nAuthor: AlienVault\nAdversary: \nTags: [\"rmmproject\", \"blockchain c2\", \"chisel\", \"etherrat\", \"credential theft\", \"clickfix\", \"dga\", \"lateral movement\", \"hidden desktop\", \"potemkin\"]\nTgtd countries: []\nMlwr families: [\"Potemkin\", \"RMMProject\", \"EtherRAT\", \"Chisel\"]\nAttack_ids: [\"T1053.005\", \"T1047\", \"T1056.001\", \"T1568.002\", \"T1036.005\", \"T1204.002\", \"T1218.007\", \"T1140\", \"T1055\", \"T1021.002\", \"T1555.003\", \"T1021.006\", \"T1218.005\", \"T1547.001\", \"T1056.002\", \"T1562.001\", \"T1027\", \"T1573\", \"T1071.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234787",
        "to_ids": true,
        "type": "domain",
        "uuid": "c097acc9-e518-447a-84a7-a33e940373f2",
        "value": "resumeacceptable.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234808",
        "to_ids": true,
        "type": "url",
        "uuid": "11d8dda7-3add-447b-8c7d-ddb122c20557",
        "value": "http://sonra.eutialyson.com/inst24.msi",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234829",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1ca2d0f5-5030-4961-833a-3543d79848f4",
        "value": "cl.distritovagas.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234850",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e07713cc-6bfd-4a36-8d76-86593206553a",
        "value": "sonra.eutialyson.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234871",
        "to_ids": true,
        "type": "url",
        "uuid": "f34af919-07df-4c28-99d1-1f57ecac6fbd",
        "value": "https://cl.distritovagas.com/hte.hta",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234892",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7d7363c6-26ec-4516-b91c-e55ff583d2ad",
        "value": "77.110.122.58",
        "Tag": [
          {
            "colour": "#c3e702",
            "local": false,
            "name": "asn:asn=\"210644\"",
            "relationship_type": ""
          },
          {
            "colour": "#c047ce",
            "local": false,
            "name": "asn:as-owner=\"AEZA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234917",
        "to_ids": true,
        "type": "domain",
        "uuid": "30b296be-db23-400f-a666-8f0a8cd25a10",
        "value": "pestrear-lamp.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232917",
        "to_ids": true,
        "type": "sha256",
        "uuid": "8318470b-2a1f-4e39-b859-10a0a230aa9d",
        "value": "2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232917",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0720fb5f-75cb-40c8-8d5d-98e38fe120f0",
        "value": "2ada24dd6e517f37942b749c2bd57ddd97445e9853002cee70a0bc30d0b0ce3a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232918",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0887b712-6197-4556-9ee1-c4753c739378",
        "value": "cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234939",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "21f2e6ab-63b2-4da6-b591-a2313f3430f9",
        "value": "213.165.41.26",
        "Tag": [
          {
            "colour": "#c3e702",
            "local": false,
            "name": "asn:asn=\"210644\"",
            "relationship_type": ""
          },
          {
            "colour": "#c047ce",
            "local": false,
            "name": "asn:as-owner=\"AEZA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234963",
        "to_ids": true,
        "type": "url",
        "uuid": "1f435140-3559-4952-ba59-91fc025ad2c0",
        "value": "http://77.110.122.58:23205/cons_1.0.1.msi",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782234986",
        "to_ids": true,
        "type": "url",
        "uuid": "87dd8d58-4f7d-456d-b2ee-2f8d02756587",
        "value": "http://77.110.122.58:23205/lQhEQui9a4lZ.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235007",
        "to_ids": true,
        "type": "url",
        "uuid": "cf206404-796d-4d91-bc0c-bfb92d377902",
        "value": "http://77.110.122.58:23205/lQhEQui9a4lZ.exe'",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235028",
        "to_ids": true,
        "type": "url",
        "uuid": "ab2bcca1-5717-49fe-a0d5-3a688a9e6f52",
        "value": "http://77.110.122.58:44479/bjxxUmG8K3uy.ps1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235049",
        "to_ids": true,
        "type": "url",
        "uuid": "49542c6d-5fc8-4ca5-88fb-405f852a18e8",
        "value": "https://resumeacceptable.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235070",
        "to_ids": true,
        "type": "domain",
        "uuid": "4cd4f282-9582-4a6e-bd16-dfc84ac2afab",
        "value": "anus-staylard.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235091",
        "to_ids": true,
        "type": "domain",
        "uuid": "eb3f005c-b8da-4f43-95ea-619b043154a5",
        "value": "fair-bath-fond.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235112",
        "to_ids": true,
        "type": "domain",
        "uuid": "f52d1412-cefc-49fe-b56a-4df4bc0104c9",
        "value": "rule-bead-dust.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235133",
        "to_ids": true,
        "type": "domain",
        "uuid": "51f57624-4024-4203-8eff-75db7152673d",
        "value": "uglyshop-mare.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 43301",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782230335",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "aee78cdf-2329-41bc-ae0c-03a0be7ee185",
        "value": "77.110.122.58|43301"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "7",
        "timestamp": "1782230283",
        "uuid": "686dcb20-cde7-4ed9-8532-1e22dd1e710a",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782230283",
            "to_ids": false,
            "type": "text",
            "uuid": "0e2db71d-faec-4f52-bbea-a8fe21bfa21d",
            "value": "PotemkinLoader"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782230283",
            "to_ids": false,
            "type": "comment",
            "uuid": "89394563-5f1c-444c-a8f4-520dee4bea14",
            "value": "Detects Potemkin Loader"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1782230283",
            "to_ids": true,
            "type": "yara",
            "uuid": "846f610e-c368-4057-a96d-20a2ff0ed32b",
            "value": "rule PotemkinLoader {\r\n   meta:       \r\n       author = \"RussianPanda\"\r\n       description = \"Detects Potemkin Loader\"\r\n       date = \"6/4/2026\"\r\n       hash = \"2abe5dd3a057fdef935722e50e               \r\n       9251c272d29fd26113187b853a1f9a9cb89d9b\"\r\n\r\n   strings:\r\n       $s1 = \"[Agent] DLL returned (updatedll), reloading...\"             ascii       \r\n       $s2 = \"dll_debug.log\" ascii\r\n       $s3 = \"[Agent] LoadAndRunDLL=\" ascii\r\n\r\n   condition:\r\n       uint16(0) == 0x5A4D and all of ($s*)\r\n}"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "7",
        "timestamp": "1782230307",
        "uuid": "d923cf9b-ec43-413f-bb5f-9d1854d066a2",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1782230307",
            "to_ids": false,
            "type": "text",
            "uuid": "ff6727cd-1aa9-4e97-98b2-dc019492cda3",
            "value": "RMMProject"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1782230307",
            "to_ids": false,
            "type": "comment",
            "uuid": "1e5caefd-e1e5-4e4d-9ae7-493b17e092fb",
            "value": "Detects RMMProject RAT"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1782230307",
            "to_ids": true,
            "type": "yara",
            "uuid": "4cc2110b-3a5f-4db3-9404-93c2f98cd40c",
            "value": "rule RMMProject {\r\n   meta:\r\n       author = \"RussianPanda\"\r\n       description = \"Detects RMMProject RAT\"\r\n       date = \"6/4/2026\"\r\n       hash = \"3b7ae925e2d64522b4f69b56285b0\r\n               5aeca8c5aab5ab46a9c02c4fafb69d881ce \"\r\n   strings:\r\n       $s1 = \"[RTSC] OpenInputSocket: sending session_id=\" ascii\r\n       $s2 = \"kCookies: total_cookies=\" ascii\r\n       $s3 = \"GetChromiumKey\" ascii\r\n  condition:\r\n       uint16(0) == 0x5A4D and all of ($s*)\r\n}"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235158",
        "uuid": "2a8084a9-68fb-4edc-8c9e-c2e28d60f3fc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235158",
            "to_ids": true,
            "type": "md5",
            "uuid": "f6052be9-fcae-4329-ac5b-0a013004a2af",
            "value": "d37cc44db90a65341263deb162024447",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232915",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bac6184d-b9d3-4ea5-a2bf-0e65b702aca8",
            "value": "4537b37b65e9dc35640d750f3fa7f4944534f6b1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232915",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d23b6df6-1e67-4333-b495-6bdae1545686",
            "value": "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231596",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9706ff56-02fc-4f2e-9467-701a371c4115",
            "value": "12288:Ac0qmT/guoTF4jgMkOERD3O6RRtM0D22/Fguq:Ac0qmT/poZ4jgMKd9RO4xj"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231596",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5a1c0b37-8988-4b58-987b-dd1d07aba975",
            "value": "1552384"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782231596",
            "to_ids": true,
            "type": "vhash",
            "uuid": "dbb792a7-b0ed-4f06-a512-bc479112d44b",
            "value": "15b92087432331eeabf1a6ef555a3ee3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231596",
            "to_ids": true,
            "type": "filename",
            "uuid": "ca657cbc-aa79-4686-9d79-3825de0e50ea",
            "value": "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231596",
            "to_ids": false,
            "type": "text",
            "uuid": "3332d544-5a89-4bcc-a501-bcc8040f0dbf",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:26/61\nFirst Submission:2026-04-23T21:28:54.000000+00:00\nLast Submission:2026-04-24T20:57:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235179",
        "uuid": "922912ec-8e5a-471e-8bf8-1c671521c009",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235179",
            "to_ids": true,
            "type": "md5",
            "uuid": "f3acbb48-6481-4d3d-ad6a-eff86c6f1d28",
            "value": "c7f2ae4ff32e96ffec6aa9a1b7d8c849",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232915",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3e2d2a08-24e5-4c60-b044-7267f9f500b9",
            "value": "80897d30bab6482d6f0177bf1c5f59937d1eaa62",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232916",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1103eaed-e9c9-4c03-ba85-7acd88f7acc4",
            "value": "3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231662",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e08c171d-e60b-4e57-8778-f41f80c6fb49",
            "value": "98304:F6uzAVfY6KuOjdIHn4xHH0vhVfjFvpbYzg0lZL76RGFPS60hW/2jRevX11bUT:F6Ds/2jRe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231662",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ef3a8cdd-8ffd-4b82-a46b-b5005fc193a9",
            "value": "4606464"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782231662",
            "to_ids": true,
            "type": "vhash",
            "uuid": "baa6a020-b21f-44cc-9c10-c84d9f03587c",
            "value": "146076656d156d0555517011z20700d17z27z301002d4z1b6z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231662",
            "to_ids": true,
            "type": "filename",
            "uuid": "2c0c40c0-cc9a-49f9-ba73-0087e81e6c85",
            "value": "k4iw1bq3.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231662",
            "to_ids": false,
            "type": "text",
            "uuid": "93f78d98-c3f9-4498-96d6-c6c7d19d002a",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/MetaStealer.AVWB!MTB\nVT Total Detection:42/69\nFirst Submission:2026-04-23T21:36:12.000000+00:00\nLast Submission:2026-04-23T21:36:12.000000+00:00"
          }
        ]
      }
    ]
  }
}