{ "Event": { "analysis": "1", "date": "2026-06-30", "extends_uuid": "", "info": "[Threat Intel] Not very gentlemanly: Analyzing a zero-day exploit used to disable targets' EDRs", "protected": false, "publish_timestamp": "1783858361", "published": true, "threat_level_id": "1", "timestamp": "1783858360", "uuid": "d15e146b-6be9-4602-9c06-8451162eeb0e", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#f8140a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": "" }, { "colour": "#f28fb8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"", "relationship_type": "" }, { "colour": "#b2a633", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Service Discovery - T1007\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#ad5a96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": "" }, { "colour": "#6d779a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"", "relationship_type": "" }, { "colour": "#cb2c9b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#150052", "local": false, "name": "rectifyq:sub-category=\"zero-day\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"the gentlemen\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows Server\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782903607", "to_ids": false, "type": "link", "uuid": "bcce5cba-c8af-453d-9ae6-a4d54211b2f2", "value": "https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782903607", "to_ids": false, "type": "text", "uuid": "dff288e7-2d2f-4af6-afe8-35b4b9d99d60", "value": "The Gentlemen ransomware group, which emerged in July 2025, employed a zero-day vulnerability in a bring-your-own-vulnerable-driver (BYOVD) attack to disable endpoint detection and response systems. During an incident investigated in early April, the group leveraged an obscure third-party driver named ktapi.sys from Kontron to bypass security protections. The sophisticated exploit chains multiple advanced techniques to navigate Windows exploit mitigations, including bypassing Supervisor Mode Access Prevention and Supervisor Mode Execution Prevention. The toolkit enables the attackers to call privileged kernel mode functions from user mode processes, ultimately terminating EDR processes including Windows Defender, ESET, Palo Alto Cortex XDR, and SentinelOne. The vulnerability had no prior public documentation and was previously absent from vulnerable driver blocklists." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782903607", "to_ids": false, "type": "text", "uuid": "3e69a0b8-1533-4838-9f9a-de08ca05b919", "value": "Name: Not very gentlemanly: Analyzing a zero-day exploit used to disable targets' EDRs\nAuthor: AlienVault\nAdversary: The Gentlemen\nTags: [\"the gentlemen\", \"edr killer\", \"byovd\", \"ransomware\", \"kontron driver\", \"zero-day\", \"endpoint protection bypass\", \"ktapi.sys\", \"kernel exploit\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1047\", \"T1003\", \"T1129\", \"T1489\", \"T1543.003\", \"T1007\", \"T1082\", \"T1106\", \"T1055\", \"T1112\", \"T1059\", \"T1497\", \"T1057\", \"T1562.001\", \"T1574\", \"T1068\", \"T1055.001\", \"T1490\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783843639", "to_ids": false, "type": "threat-actor", "uuid": "137ac011-da04-4587-b489-13b60e208b89", "value": "The Gentlemen", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"the gentlemen\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783847187", "uuid": "db2c4c2a-9c92-41cb-8a08-a3d04067c8a9", "Attribute": [ { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "md5", "timestamp": "1783847187", "to_ids": true, "type": "md5", "uuid": "06f46ae8-56b1-4229-bc2b-68260e4750da", "value": "96a8b9db2dc9cba8cdf90c7c33fe11c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "sha1", "timestamp": "1783846921", "to_ids": true, "type": "sha1", "uuid": "a3965aa7-44d5-4b30-932f-97afab966797", "value": "86c85f4cbc36377d6fdb3f2af7d3049d5174c62c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "sha256", "timestamp": "1783846921", "to_ids": true, "type": "sha256", "uuid": "7482cd47-7742-4e47-9118-84e8215871fd", "value": "7ee17efef04bb7c9de90d5210263ed6993f867e5a11f86e65e3bb1362c7de237", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "text", "timestamp": "1783845794", "to_ids": false, "type": "text", "uuid": "ebe5b728-d4d1-4ea4-b62c-cfd5822d6153", "value": "Vulnerable driver\r\nType Description: Win32 EXE\nOriginal name: ktapi.sys\nVerified: Signed\nSigning date: 08:13 AM 11/08/2012\nSigners: Kontron AG; GlobalSign CodeSigning CA - G2; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2023-03-24T15:48:52+00:00\nLast Submission: 2026-07-12T00:48:53+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "creation-time", "timestamp": "1783845794", "to_ids": false, "type": "datetime", "uuid": "d0961971-7d48-43dc-afef-89e06cc73b59", "value": "2012-11-08T08:13:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "ssdeep", "timestamp": "1783845794", "to_ids": true, "type": "ssdeep", "uuid": "d71f3dea-1119-4771-ad3a-159f5340ba57", "value": "384:VnAbnAp0H6dneQWm83mirILvKzACvYDXdUb+q:VADApC6dneQ3nIILvcPLiq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1783845794", "to_ids": false, "type": "size-in-bytes", "uuid": "79cf411c-37f6-4baf-bc4d-9e5a94603cec", "value": "14288" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "vhash", "timestamp": "1783845794", "to_ids": true, "type": "vhash", "uuid": "dfcc6f6a-ed47-486f-9961-b1e49e8e7ccf", "value": "014066551d151e1519z27zcxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-03-24T15:48:52+00:00", "last_seen": "2026-07-12T00:48:53+00:00", "object_relation": "filename", "timestamp": "1783845794", "to_ids": true, "type": "filename", "uuid": "4a07942f-9040-461c-a6a4-1ce4e459937a", "value": "ktapi.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783847208", "uuid": "6a8db9a3-1697-4d84-ae83-5e6ed527ebea", "Attribute": [ { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "md5", "timestamp": "1783847208", "to_ids": true, "type": "md5", "uuid": "48a7bb29-ffde-4eec-9d53-23d8be6e49a0", "value": "2c10be1aea72b7bdf07c735a4ad68876", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "sha1", "timestamp": "1783846922", "to_ids": true, "type": "sha1", "uuid": "f0837a9e-8433-4713-b11f-a7c3853676fe", "value": "8b5cf43fba2c2226e6146ee065490dad17acc820", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "sha256", "timestamp": "1783846922", "to_ids": true, "type": "sha256", "uuid": "56c51e36-dbcb-45a9-af17-20c88d5fe09e", "value": "9ca9432b0d29204cb5420a1a6b01533d4552130c2a8a5ecd7837efadefb4a046", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 09/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "text", "timestamp": "1783845816", "to_ids": false, "type": "text", "uuid": "bf1652d2-4b38-4d01-b613-d9ae3144fa7d", "value": "Vulnerable driver\r\nType Description: Win32 EXE\nOriginal name: ktapi.sys\nVerified: Signed\nSigning date: 12:22 PM 05/07/2013\nSigners: Kontron AG; GlobalSign CodeSigning CA - G2; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 7/74\nFirst Submission: 2016-12-28T10:35:47+00:00\nLast Submission: 2016-12-28T10:35:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "creation-time", "timestamp": "1783845816", "to_ids": false, "type": "datetime", "uuid": "dcd2f0d7-b696-4de1-842d-18619a827f6d", "value": "2013-05-07T12:22:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "ssdeep", "timestamp": "1783845816", "to_ids": true, "type": "ssdeep", "uuid": "14e0be3f-3232-4e43-8787-2f5183a8ceba", "value": "384:wnAbnAp0H6OneQqLXn2KzACvYD8PLQdUb+98K:wADApC6OneQOX2cP9i98K" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1783845816", "to_ids": false, "type": "size-in-bytes", "uuid": "3407ac9d-d716-48e6-b7ca-a185bc9ea23c", "value": "14728" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "vhash", "timestamp": "1783845816", "to_ids": true, "type": "vhash", "uuid": "66953c06-cdfa-42b9-8929-ef353006e8a8", "value": "014066551d151e1519z27zcxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-12-28T10:35:47+00:00", "last_seen": "2016-12-28T10:35:47+00:00", "object_relation": "filename", "timestamp": "1783845816", "to_ids": true, "type": "filename", "uuid": "bc8f59f4-9b64-4702-8859-642ba2aeab28", "value": "ktapi.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783847229", "uuid": "04e51ed1-411e-40f5-9078-d3391617bb65", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit payload", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "md5", "timestamp": "1783847229", "to_ids": true, "type": "md5", "uuid": "06a4cdb6-1891-4d3b-af0f-57a6717d75c0", "value": "ab09196e5d580694fff0eae4ad55681f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit payload", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "sha1", "timestamp": "1783846924", "to_ids": true, "type": "sha1", "uuid": "282b5098-e4c6-4faf-be05-d379a8ca58a6", "value": "af20c56cc1ae8a12116f0d914c712110bc0bee92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit payload", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "sha256", "timestamp": "1783846924", "to_ids": true, "type": "sha256", "uuid": "d7094595-2721-4741-9a3f-091089040f47", "value": "c277ae5a4dd62f51de5278790796cd2700de7f77ea17762e97729f27872d076b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 04/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "text", "timestamp": "1783845838", "to_ids": false, "type": "text", "uuid": "13a8cdf8-d777-40b9-bb33-477e286690d1", "value": "Exploit payload\r\nType Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 15/74\nFirst Submission: 2026-04-06T17:43:50+00:00\nLast Submission: 2026-04-06T17:43:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "creation-time", "timestamp": "1783845838", "to_ids": false, "type": "datetime", "uuid": "66f4a99f-ba0c-4000-8e8a-eed87f87fe68", "value": "2026-03-28T18:07:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "ssdeep", "timestamp": "1783845838", "to_ids": true, "type": "ssdeep", "uuid": "6eb98c1b-9fd2-4e54-94d3-53daba82d356", "value": "6144:zjwDAXaJbc2AZ5neQkg2qzCCDf4mAzF0:o9bRAZkPlqzCCDf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1783845838", "to_ids": false, "type": "size-in-bytes", "uuid": "5f32dd28-dc86-4866-bc62-737fb5590fd4", "value": "246272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "vhash", "timestamp": "1783845838", "to_ids": true, "type": "vhash", "uuid": "d1789b96-ac24-4bfd-b48f-9579548acbcf", "value": "025076655d155d05555az4e3z7@z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-06T17:43:50+00:00", "last_seen": "2026-04-06T17:43:50+00:00", "object_relation": "filename", "timestamp": "1783845838", "to_ids": true, "type": "filename", "uuid": "347abaaf-18b5-4115-bfb9-188205d03b01", "value": "d9nh7.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783847250", "uuid": "2a1e4c1e-0485-4253-99ed-969a25e57a9a", "Attribute": [ { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "md5", "timestamp": "1783847250", "to_ids": true, "type": "md5", "uuid": "f0641e05-997d-43e4-b35d-ff1d0b33dc31", "value": "e3c123a2ee4720001ed35d45fa1e57eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "sha1", "timestamp": "1783846925", "to_ids": true, "type": "sha1", "uuid": "ebec4485-7cbc-4871-9b78-9f6049b3515f", "value": "92f5c4fd5791db408fa801fd3d887870691af1f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Vulnerable driver", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "sha256", "timestamp": "1783846925", "to_ids": true, "type": "sha256", "uuid": "85e78e5b-d8de-4bdc-9e07-854548e9d917", "value": "89ba754861e11d9db4440b2b5db61fd5bee16752e4623c4271b8fdd0a666c677", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "text", "timestamp": "1783845860", "to_ids": false, "type": "text", "uuid": "bf958b01-6897-430b-9002-34fb2fa0b696", "value": "Vulnerable driver\r\nType Description: Win32 EXE\nOriginal name: ktapi.sys\nVerified: Signed\nSigning date: 12:22 PM 05/07/2013\nSigners: Kontron AG; GlobalSign CodeSigning CA - G2; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/73\nFirst Submission: 2016-12-28T10:35:54+00:00\nLast Submission: 2016-12-28T10:35:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "creation-time", "timestamp": "1783845860", "to_ids": false, "type": "datetime", "uuid": "d67f3c5b-e6aa-4fa3-be87-65e4a941642e", "value": "2013-05-07T12:22:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "ssdeep", "timestamp": "1783845860", "to_ids": true, "type": "ssdeep", "uuid": "4ff711d7-ccd1-47b3-aa09-1f6b876fb4a0", "value": "192:JJVqP2SB3qsAEknVTgBxe1HCjNgP4Cvl01DF7+e+PjPQ8jSJUbueqNNsoo:JJohhqLLn2KzACvYD8PLQdUb+Y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1783845860", "to_ids": false, "type": "size-in-bytes", "uuid": "77930b97-752c-4fee-8759-56f393aa3e01", "value": "13704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "vhash", "timestamp": "1783845860", "to_ids": true, "type": "vhash", "uuid": "06e9ccd3-7c36-4936-9f1e-c125d730cc61", "value": "014066551d1e151519z87zdxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-12-28T10:35:54+00:00", "last_seen": "2016-12-28T10:35:54+00:00", "object_relation": "filename", "timestamp": "1783845860", "to_ids": true, "type": "filename", "uuid": "48d9a20e-9aba-4de0-ba62-60923537c807", "value": "ktapi.sys" } ] } ] } }