{ "Event": { "analysis": "1", "date": "2026-07-27", "extends_uuid": "", "info": "[Threat Intel] Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection", "protected": false, "publish_timestamp": "1785616372", "published": true, "threat_level_id": "3", "timestamp": "1785616372", "uuid": "d0dc93f1-4eb7-4961-bedf-e8a97050039d", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#d2ee74", "local": false, "name": "misp-galaxy:producer=\"Arctic Wolf\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#3bc6ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"CASTLELOADER\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Exodus\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"LOBSHOT\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785236416", "to_ids": false, "type": "link", "uuid": "493cfd75-c3c3-4dc2-9092-d515f93788ba", "value": "https://arcticwolf.com/resources/blog/castleloader-new-campaigns-new-tooling-and-the-needlestealer-connection/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1785236416", "to_ids": false, "type": "text", "uuid": "7862364c-f3be-446e-bb4e-93164f044755", "value": "Arctic Wolf Labs has been tracking multiple campaigns built around CastleLoader, a multi-stage shellcode loader that has evolved significantly. Three distinct campaigns were identified: Urutyka, Garrigin, and Noidret. The most significant development is the integration of NeedleStealer framework payloads, marking the first observed use of Rust and Golang tooling in this campaign cluster. NeedleStealer includes a Rust-based desktop cryptocurrency wallet spoofer targeting Ledger, Trezor, and Exodus wallets, and a Golang-based malicious browser extension installer. The campaigns utilize obfuscated PowerShell stagers, IronPython runtimes, and NodeJS-based shellcode injectors. Infrastructure analysis revealed consistent naming patterns, staged domains for future operations, and the use of fraudulently obtained code-signing certificates. The campaigns consistently deploy NetSupport RAT and CastleStealer alongside the new NeedleStealer payloads, suggesting an expansion toward high-value cryptocurrency targeting." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1785236416", "to_ids": false, "type": "text", "uuid": "86d471bf-b1c2-4765-8abf-272be6d5bde1", "value": "Name: Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection\nAuthor: AlienVault\nAdversary: \nTags: [\"needlestealer\", \"cryptocurrency theft\", \"browser extension\", \"lobshot\", \"ironpython\", \"boryptgrab\", \"castlestealer\", \"powershell stager\", \"pythonrat\", \"netsupport rat\", \"wallet spoofer\", \"castleloader\"]\nTgtd countries: []\nMlwr families: [\"CastleLoader\", \"CastleStealer\", \"PythonRAT\", \"NetSupport RAT\", \"NeedleStealer\", \"Lobshot\", \"BoryptGrab\"]\nAttack_ids: [\"T1539\", \"T1553.002\", \"T1082\", \"T1106\", \"T1140\", \"T1036\", \"T1055\", \"T1218\", \"T1185\", \"T1555.003\", \"T1083\", \"T1204\", \"T1059.001\", \"T1566\", \"T1027\", \"T1573\", \"T1070.004\", \"T1071.001\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603359", "to_ids": true, "type": "domain", "uuid": "27edfd88-620b-4a57-bede-1eb3d5b0397a", "value": "teamsvoicepremium.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603380", "to_ids": true, "type": "domain", "uuid": "471a7c34-b172-4933-88c7-513a856b9b81", "value": "italianhitech.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603401", "to_ids": true, "type": "ip-dst", "uuid": "b236c4db-6f47-4bf7-98b3-b6f73333c098", "value": "94.26.90.112", "Tag": [ { "colour": "#3668c7", "local": false, "name": "asn:asn=\"25211\"", "relationship_type": "" }, { "colour": "#b17da9", "local": false, "name": "asn:as-owner=\"EUROCRYPT-AS\"", "relationship_type": "" }, { "colour": "#059db5", "local": false, "name": "asn:as-country=\"BG\"", "relationship_type": "" }, { "colour": "#390b5f", "local": false, "name": "misp-galaxy:country=\"bulgaria\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603423", "to_ids": true, "type": "domain", "uuid": "8993b617-f133-4fba-96dc-a291d534c19b", "value": "ebedidance.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603444", "to_ids": true, "type": "domain", "uuid": "0f18ba78-e835-461c-b32f-a1dd0f57b254", "value": "drrajivparti.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785236417", "to_ids": false, "type": "vulnerability", "uuid": "11c35546-ac1f-4dde-8ddf-7b5c994f905d", "value": "CVE-2026-0257" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603465", "to_ids": true, "type": "domain", "uuid": "7cf1ef40-5aeb-4475-b840-b95e47f23844", "value": "p-rala.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785236417", "to_ids": false, "type": "vulnerability", "uuid": "ca79e01c-51b6-422d-a3e5-e8718a4b0ca5", "value": "CVE-2026-48558" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603486", "to_ids": true, "type": "domain", "uuid": "463ff698-ca3b-4b90-9183-c6112e13e503", "value": "avivtech.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603508", "to_ids": true, "type": "domain", "uuid": "7b2e7603-dd67-449a-83a7-2f74f6e2d7e8", "value": "claudettes.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603529", "to_ids": true, "type": "domain", "uuid": "e84ff0cc-60a8-44bd-811b-7fcfb6cabcf2", "value": "skipraid.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785600970", "to_ids": true, "type": "md5", "uuid": "55c97c05-b288-4761-a55f-48e54e189424", "value": "1390903f57b21f346193aefbbfd36759", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785600972", "to_ids": true, "type": "md5", "uuid": "530d5b13-f3aa-42a5-8b93-091df12b6b8f", "value": "4d5f81bf79554aa7a2187e6ffbc9702a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785600973", "to_ids": true, "type": "md5", "uuid": "8363acd7-9c48-45dd-a530-7dbf2517feb1", "value": "6728b11f74fd435f926ed25c5f2952bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603550", "to_ids": true, "type": "ip-dst", "uuid": "861bf000-ad4b-47ef-b05c-8cb227e7569e", "value": "179.132.128.189", "Tag": [ { "colour": "#d16de1", "local": false, "name": "asn:asn=\"26599\"", "relationship_type": "" }, { "colour": "#f00d83", "local": false, "name": "asn:as-owner=\"TELEFONICA BRASIL S.A\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603571", "to_ids": true, "type": "ip-dst", "uuid": "8090e50b-a8ad-44ce-812e-9567e8a9bf9f", "value": "216.107.139.188", "Tag": [ { "colour": "#8d6d4c", "local": false, "name": "asn:asn=\"396356\"", "relationship_type": "" }, { "colour": "#d93ddc", "local": false, "name": "asn:as-owner=\"LATITUDE-SH\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603592", "to_ids": true, "type": "ip-dst", "uuid": "049be64b-6790-44b1-9d5f-cfb2b59ed367", "value": "91.92.33.167", "Tag": [ { "colour": "#3668c7", "local": false, "name": "asn:asn=\"25211\"", "relationship_type": "" }, { "colour": "#b17da9", "local": false, "name": "asn:as-owner=\"EUROCRYPT-AS\"", "relationship_type": "" }, { "colour": "#059db5", "local": false, "name": "asn:as-country=\"BG\"", "relationship_type": "" }, { "colour": "#390b5f", "local": false, "name": "misp-galaxy:country=\"bulgaria\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603613", "to_ids": true, "type": "url", "uuid": "e89a4e33-0034-4ce6-862a-7b3cfc344b8c", "value": "http://94.26.90.112/dl-callback/6dkcdpd7-4jacbuf9-prutgux4-2ybssc8v/traffic1.exe/1390903f57b21f346193aefbbfd36759", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603634", "to_ids": true, "type": "url", "uuid": "5be14642-b901-4cb0-b768-c0dfa2c11a7a", "value": "http://eazysitebuilder.com:4889", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603655", "to_ids": true, "type": "url", "uuid": "9f26409e-c1c2-45f8-91fe-9b0325c8acab", "value": "http://goodbytetelegramm.com/xxx/main", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603677", "to_ids": true, "type": "url", "uuid": "0e9e636c-1588-4fa6-8852-87b7c4591ab2", "value": "http://socom-game.com:5500", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603698", "to_ids": true, "type": "url", "uuid": "a3485641-fca2-48b6-9733-d282fca781ca", "value": "http://urutyka.com/xxx/viewer32", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603719", "to_ids": true, "type": "domain", "uuid": "b3356e88-0b94-42f3-8f2b-9b813ca4bbf7", "value": "claudenell.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603740", "to_ids": true, "type": "domain", "uuid": "e72ea9ea-fb88-4d49-8e61-90a73a4f1b7a", "value": "eazysitebuilder.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603761", "to_ids": true, "type": "domain", "uuid": "19fb6879-b80f-4886-a340-d406e9251e59", "value": "fangorinaf.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603782", "to_ids": true, "type": "domain", "uuid": "9ea6a6f9-d63b-41c6-9555-391c6304a2a9", "value": "garrigin.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603805", "to_ids": true, "type": "domain", "uuid": "70001e43-e1f8-41ce-8f44-eaf8f286ef8d", "value": "goodbytetelegramm.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603826", "to_ids": true, "type": "domain", "uuid": "d4e9ed46-d9ae-4d57-b489-ae1355181126", "value": "grenagana.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603847", "to_ids": true, "type": "domain", "uuid": "f06aa5f8-b4bd-456f-87c8-8f3758f8cf42", "value": "grorriner.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603868", "to_ids": true, "type": "domain", "uuid": "59f25459-fe08-49a3-bb13-0f4cddf595bb", "value": "hobtech.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603889", "to_ids": true, "type": "domain", "uuid": "7920fdcf-73f1-4b27-a387-1d8ef25ebeda", "value": "kaneta.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603911", "to_ids": true, "type": "domain", "uuid": "86448db3-ba88-43ee-8c2b-4712219bdd44", "value": "monblare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603932", "to_ids": true, "type": "domain", "uuid": "5e442c99-cec9-4b95-a51b-9bed2bfcfc6f", "value": "noidret.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603953", "to_ids": true, "type": "domain", "uuid": "9986c3fe-48be-493d-8546-d4a67180ba90", "value": "quiantar.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603974", "to_ids": true, "type": "domain", "uuid": "7ec7f9ef-49cb-4a52-ae91-c4ad4dd7db1a", "value": "qxvnrta.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785603995", "to_ids": true, "type": "domain", "uuid": "c4fab091-de96-4109-90dd-3a1c90734801", "value": "socom-game.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785604016", "to_ids": true, "type": "domain", "uuid": "46611ad7-d884-4576-bcd5-e4867c289620", "value": "strainted.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785604037", "to_ids": true, "type": "domain", "uuid": "06bf66f9-e7af-41fa-9b11-41fbf5315a3d", "value": "thenugcompany.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785604058", "to_ids": true, "type": "domain", "uuid": "9a74c0e8-8309-4f0e-9503-161480c8a46a", "value": "urutyka.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "NeedleStealer (Golang) 32bit C2", "deleted": false, "disable_correlation": false, "timestamp": "1785604079", "to_ids": true, "type": "ip-dst", "uuid": "40843862-e408-4ea3-9276-6ac6df1268e3", "value": "84.201.6.21", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 / download URL", "deleted": false, "disable_correlation": false, "timestamp": "1785604100", "to_ids": true, "type": "url", "uuid": "f5044adc-780d-462f-90b7-581db74e7ad0", "value": "https://pub-4d5f81bf79554aa7a2187e6ffbc9702a.r2.dev/traffic1.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...nd PS1 script and contacts the download server at pub-6728b11f74fd435f926ed25c5f2952bb[.]r2[.]dev to drop the traffic1.ms1 file. Figure 1: Initial...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785604121", "to_ids": true, "type": "domain", "uuid": "95312058-d7ad-434d-ab68-7f696af89998", "value": "pub-6728b11f74fd435f926ed25c5f2952bb.r2.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 / download URL", "deleted": false, "disable_correlation": false, "timestamp": "1785604143", "to_ids": true, "type": "domain", "uuid": "6b3cfe48-a343-4e4c-9e16-a35f7b9d5ba9", "value": "pub-4d5f81bf79554aa7a2187e6ffbc9702a.r2.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "NeedleStealer (Rust + Golang) C2", "deleted": false, "disable_correlation": false, "timestamp": "1785604164", "to_ids": true, "type": "domain", "uuid": "73c984c2-04cc-4506-8a18-88fa8f9dca2e", "value": "kileant.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785604185", "uuid": "cb314fb4-4747-41c7-a7a2-b08ff90d4e44", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "md5", "timestamp": "1785604185", "to_ids": true, "type": "md5", "uuid": "9d91d91b-bed7-49d8-895f-e44dd9e9e6a0", "value": "cfb12735b005d12a36c1e63de6175ebd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "sha1", "timestamp": "1785600964", "to_ids": true, "type": "sha1", "uuid": "8df89e82-cfea-41d2-9d16-8e460d8a5cb6", "value": "5472e75bd286418cf826416d646e1612314c3882", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "sha256", "timestamp": "1785600964", "to_ids": true, "type": "sha256", "uuid": "8446ac20-63e9-420e-9c06-dd75f38fc241", "value": "d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "text", "timestamp": "1785600658", "to_ids": false, "type": "text", "uuid": "66423db1-9a27-4f5e-8395-6b837e3b554e", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 04:30 PM 05/14/2026\nSigners: TECHNOLOGY APPRAISALS LIMITED; Microsoft ID Verified CS EOC CA 03; Microsoft ID Verified Code Signing PCA 2021; Microsoft Identity Verification Root Certificate Authority 2020\nMicrosoft: None\nClamAV: None\nVT Total Detection: 34/75\nFirst Submission: 2026-05-15T20:11:35+00:00\nLast Submission: 2026-06-09T22:26:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "creation-time", "timestamp": "1785600658", "to_ids": false, "type": "datetime", "uuid": "fd111c1c-0c08-4e07-bfe4-188f4e0d9924", "value": "2026-04-19T20:38:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "ssdeep", "timestamp": "1785600658", "to_ids": true, "type": "ssdeep", "uuid": "8e1131eb-4364-458e-9a3a-fc5ec568dfac", "value": "3145728:tLaqeuFn44mS+xYTqk/gsGKyu3dUfTAlvZtniJU0Fg2:F9pFOKTAsZyuNCARn45FD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600658", "to_ids": false, "type": "size-in-bytes", "uuid": "582b3e9a-bcd1-4461-bb5e-4b836f54bd2e", "value": "103332856" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "vhash", "timestamp": "1785600658", "to_ids": true, "type": "vhash", "uuid": "a127dcf4-9597-4d76-a625-5880b1be9d1c", "value": "018056655d1c0550c043z800417z57z52z4gz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-15T20:11:35+00:00", "last_seen": "2026-06-09T22:26:43+00:00", "object_relation": "filename", "timestamp": "1785600658", "to_ids": true, "type": "filename", "uuid": "20d83531-4be8-4b5d-b8c1-e922f2475d76", "value": "setup" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785604206", "uuid": "f85854b0-469a-4d61-be2b-143c475bec68", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "md5", "timestamp": "1785604206", "to_ids": true, "type": "md5", "uuid": "3f7e880e-9a12-44ba-9dc1-d8986f5d4745", "value": "20e5488a5d349258460f88805c30a197", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "sha1", "timestamp": "1785600965", "to_ids": true, "type": "sha1", "uuid": "7496ad75-8f43-449c-bcc5-5489ec6b5a64", "value": "1cb90f0b5a4f19cb8b0adfb33a9e4813c74c4e54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "sha256", "timestamp": "1785600965", "to_ids": true, "type": "sha256", "uuid": "e477f35a-78de-474d-b54b-4d275a8819f8", "value": "2fcf553b9656523b3207c08cdf16f7be9a25e55cf8c29f5caf933151c9214367", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "text", "timestamp": "1785600679", "to_ids": false, "type": "text", "uuid": "01394852-44aa-4b0e-89cb-50db7b54cf03", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 46/75\nFirst Submission: 2026-03-26T10:08:40+00:00\nLast Submission: 2026-06-19T21:03:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "creation-time", "timestamp": "1785600679", "to_ids": false, "type": "datetime", "uuid": "c84e8c30-e7d0-46a9-aef4-9f31cee89110", "value": "2012-09-11T20:26:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "ssdeep", "timestamp": "1785600679", "to_ids": true, "type": "ssdeep", "uuid": "e3427d3e-1825-4f77-a1cf-a0220c73f0d4", "value": "3072:fLeqaMRJJDCgRKK350jI8yiAcKjuKqOI1s0BRlE:fLeSJJegRK850jI8KjuKDIpBRlE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600679", "to_ids": false, "type": "size-in-bytes", "uuid": "1baa2230-60e0-4089-ad79-1231e873976d", "value": "201216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "vhash", "timestamp": "1785600679", "to_ids": true, "type": "vhash", "uuid": "549150e9-fd82-4271-b670-92f04fda2013", "value": "125066655d7555555055z90068z17z42z46ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-26T10:08:40+00:00", "last_seen": "2026-06-19T21:03:06+00:00", "object_relation": "filename", "timestamp": "1785600679", "to_ids": true, "type": "filename", "uuid": "b8fa166a-6dc9-4724-8931-6fac9a9a9243", "value": "2fcf553b9656523b3207c08cdf16f7be9a25e55cf8c29f5caf933151c9214367.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785604227", "uuid": "89ca1fa4-07cf-4446-b876-de8d0e31daee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "md5", "timestamp": "1785604227", "to_ids": true, "type": "md5", "uuid": "d38934d7-46bf-4332-984c-705198806282", "value": "7e60564d9d3e66742e388dd8e16c16b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "sha1", "timestamp": "1785600967", "to_ids": true, "type": "sha1", "uuid": "3f041cc8-e29d-45d7-a42f-29e00796389c", "value": "1360f94e89c08ed4c8a4f853774dcf21e4254874", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "sha256", "timestamp": "1785600967", "to_ids": true, "type": "sha256", "uuid": "e6217b79-4f03-432d-96ad-f79be775282c", "value": "0c48fd6a18ad9c701b254bbdd412efbf7dfdd2be6534a61c14bce719d259df9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "text", "timestamp": "1785600765", "to_ids": false, "type": "text", "uuid": "270ebf5c-dc82-4468-866c-36c8f678296e", "value": "Type Description: DOS EXE\nMicrosoft: Trojan:Script/Wacatac.C!ml\nClamAV: None\nVT Total Detection: 2/75\nFirst Submission: 2026-06-19T16:03:32+00:00\nLast Submission: 2026-06-19T17:04:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "ssdeep", "timestamp": "1785600765", "to_ids": true, "type": "ssdeep", "uuid": "57db9502-ff96-4c07-8c6c-bad041c8614f", "value": "3072:PTdb4R9q7xy4As9swizElDZixJ8T9Gf4x7xSO3bqY9B3+QNoIidchQ:PTdb44sBQlDZa2M4x7xSObPz+bIimhQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600765", "to_ids": false, "type": "size-in-bytes", "uuid": "bf82ab2d-8581-4290-b6c2-57b5f13815bc", "value": "311509" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T16:03:32+00:00", "last_seen": "2026-06-19T17:04:38+00:00", "object_relation": "filename", "timestamp": "1785600765", "to_ids": true, "type": "filename", "uuid": "ce3d790f-238b-4c9e-8966-902776d24d77", "value": "2fcf553b9656523b3207c08cdf16f7be9a25e55cf8c29f5caf933151c9214367.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785604248", "uuid": "b92a5bd0-a887-4795-9a79-67b058cd5b40", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "md5", "timestamp": "1785604248", "to_ids": true, "type": "md5", "uuid": "ad29dae8-38ac-4ea4-a9cf-ec95e875001d", "value": "4fbb10690ac955a3f58d5c5b2ca3944c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "sha1", "timestamp": "1785600968", "to_ids": true, "type": "sha1", "uuid": "38d78ae2-40dc-494a-88cb-62dbaa60c34d", "value": "49c5ef64ae305ac65d19fb3f140aea95d4d09485", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "sha256", "timestamp": "1785600968", "to_ids": true, "type": "sha256", "uuid": "1e420e65-2f7f-46c3-8144-66b02a27de49", "value": "edff43ecdf7aa476331d925db04e68a2251920165a2109be9df91a56d86b87c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "text", "timestamp": "1785600787", "to_ids": false, "type": "text", "uuid": "1147a72f-9320-4480-85b7-30f687782e00", "value": "Type Description: MS Compress\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/75\nFirst Submission: 2026-05-17T07:01:22+00:00\nLast Submission: 2026-05-18T21:19:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "ssdeep", "timestamp": "1785600787", "to_ids": true, "type": "ssdeep", "uuid": "6acd5623-56d9-4618-82da-905d39d8a5bb", "value": "192:WFZVO0cnVwVtPli80vqqqGpizN76M6EUw+yBeXlpINRvMo:MVjxVtPlGv/5p4p6MdAyBeXPi2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600787", "to_ids": false, "type": "size-in-bytes", "uuid": "578e6faf-f290-4802-8e29-c9bebb9ea882", "value": "8832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-17T07:01:22+00:00", "last_seen": "2026-05-18T21:19:57+00:00", "object_relation": "filename", "timestamp": "1785600787", "to_ids": true, "type": "filename", "uuid": "b8d82a8c-79b8-4c3c-a154-d06efcd7796a", "value": "shellcode.bin" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785604269", "uuid": "236ceaba-1778-4ad2-9544-94dd33a6ff42", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "md5", "timestamp": "1785604269", "to_ids": true, "type": "md5", "uuid": "ea5b36e1-293a-444a-85e3-310eaa20acc3", "value": "5a56b8c7755bb868f5a9ff5f3442d2a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "sha1", "timestamp": "1785600969", "to_ids": true, "type": "sha1", "uuid": "e9e6e963-15f4-459d-a96d-b28664c87cab", "value": "dd366d150b6adaf0d916e42fe29d90e1334b1444", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "sha256", "timestamp": "1785600969", "to_ids": true, "type": "sha256", "uuid": "c96cfe6f-4513-4263-8715-c35c0b37d7d8", "value": "fa67487da701ce1d61ee3abb84869f669a6c2aa50ca0148a3c4a87e667716638", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "text", "timestamp": "1785600808", "to_ids": false, "type": "text", "uuid": "278a520c-4294-430f-b8a2-a1fccf02bb44", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 41/75\nFirst Submission: 2026-05-22T12:27:56+00:00\nLast Submission: 2026-05-22T12:27:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "creation-time", "timestamp": "1785600808", "to_ids": false, "type": "datetime", "uuid": "cefb9ff3-b93b-458b-abf6-610ac31a520f", "value": "2011-01-18T16:01:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "ssdeep", "timestamp": "1785600808", "to_ids": true, "type": "ssdeep", "uuid": "64a5f2c9-6f7b-44c4-b272-3883fa68a0b2", "value": "3072:15k9KaJceeElA7i+FpMqmJr1TARPYAMZ0Ocu4ws0BR6yV:15Je7lA7i+FpmJr1TfAMZwu4cBRt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600808", "to_ids": false, "type": "size-in-bytes", "uuid": "4043667e-fab5-4cdb-899e-b671901c9500", "value": "206336" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "vhash", "timestamp": "1785600808", "to_ids": true, "type": "vhash", "uuid": "b19c1810-3151-4887-aae1-e4ef08b68a26", "value": "125066655d7555555075z900617z17z42z47ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-22T12:27:56+00:00", "last_seen": "2026-05-22T12:27:56+00:00", "object_relation": "filename", "timestamp": "1785600808", "to_ids": true, "type": "filename", "uuid": "22f6c0e8-dbf8-4f29-8d89-2b89b672811f", "value": "kyj067gr.exe" } ] } ] } }