{ "Event": { "analysis": "1", "date": "2026-07-13", "extends_uuid": "", "info": "[Threat Intel] CrashStealer: C++ macOS Infostealer Posing as Crash Reporter", "protected": false, "publish_timestamp": "1784437680", "published": true, "threat_level_id": "3", "timestamp": "1784437680", "uuid": "d1c0850e-7b42-4f30-bdec-9c13e026f329", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"macOS\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AMOS\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784026810", "to_ids": false, "type": "link", "uuid": "499a21d1-4ada-49d3-aea8-c0fb5204152a", "value": "https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784026810", "to_ids": false, "type": "text", "uuid": "3129049d-70cb-4894-a5a3-e2d51ca0c757", "value": "A newly discovered macOS infostealer, implemented in native C++, impersonates Apple's crash-reporting framework to harvest sensitive data. The malware is distributed through a signed and notarized dropper application that bypasses Gatekeeper, then downloads and installs the payload from attacker infrastructure. The stealer validates victim passwords locally using dscl, unlocks the login keychain, and collects browser credentials, cryptocurrency wallet extensions, password manager data, and keychain material. Collected data is encrypted using AES-GCM before being packaged into hidden ZIP archives and exfiltrated to a command-and-control server. The malware establishes persistence by copying itself to a hidden directory and installing a LaunchAgent. It employs control-flow flattening, encrypted strings, and anti-debugging techniques to resist analysis. The campaign uses GitHub for initial staging and multiple fake collaboration software domains as lures." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784026810", "to_ids": false, "type": "text", "uuid": "37d8191e-d641-4b5b-811d-c544461f7673", "value": "Name: CrashStealer: C++ macOS Infostealer Posing as Crash Reporter\nAuthor: AlienVault\nAdversary: \nTags: [\"crashstealer\", \"macos\", \"infostealer\", \"notarized dropper\"]\nTgtd countries: []\nMlwr families: [\"CrashStealer\"]\nAttack_ids: []\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435735", "to_ids": true, "type": "domain", "uuid": "448a2dc1-f887-44dc-a616-d22da503edbc", "value": "cohezo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435756", "to_ids": true, "type": "domain", "uuid": "28d31f06-a0e3-4a5a-8798-79ff974930e1", "value": "werknova.co", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435777", "to_ids": true, "type": "domain", "uuid": "a7ab9cf5-0f25-469d-97ae-2e9038283ccc", "value": "endpoint-api-v1.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435798", "to_ids": true, "type": "url", "uuid": "b4415246-4483-4a28-90e6-94b4f9f1201a", "value": "https://endpoint-api-v1.com/login", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435819", "to_ids": true, "type": "domain", "uuid": "b4e5f965-85ef-47d4-87fd-ab8298b5203a", "value": "werkbit.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784434539", "to_ids": true, "type": "sha256", "uuid": "2f2e38be-965e-4bfd-9bd2-fdc5cc55d730", "value": "5bb675af9c403896d5f31611cf42304cf482d16f6f3ab6a868a9aa853aa5c179", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784434541", "to_ids": true, "type": "sha256", "uuid": "0dc6fdba-0134-4391-82d4-e3c4baf2e421", "value": "88334ea00ff94a366cd2a9283a508b97c269839894fddfe91913f3d92e95b6ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435840", "to_ids": true, "type": "url", "uuid": "a7bf383b-ed00-4e9a-ba34-346cbb4b780b", "value": "http://endpoint-api-v1.com/d/f1b24e/download", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435861", "to_ids": true, "type": "url", "uuid": "ce52a2b2-7161-41de-aaf0-188a1b0a85eb", "value": "https://cohezo.com/calendar/0f4df3a7-5914-4245-a616-311ca554ee0c", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435883", "to_ids": true, "type": "url", "uuid": "3f3d5fcd-1f54-4689-88bf-4be9c3294fd8", "value": "https://cohezo.io/download?invite=OX-3SEY-64KI", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435905", "to_ids": true, "type": "url", "uuid": "cd158aba-cdab-40f7-b5de-63037c387e34", "value": "https://collabox.uk/calendar/1cdf0e32-9ba0-4be5-8823-39a2e6364a20", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435926", "to_ids": true, "type": "url", "uuid": "fcc1ab1f-5b20-467f-a43a-40c64e55af6a", "value": "https://cordinex.io/download?invite=MZ-AB95-QD50", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435947", "to_ids": true, "type": "url", "uuid": "6144cbb9-a2af-46a7-a661-4c8112553eb5", "value": "https://endpoint-api-v1.com/d/f1b24e", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435968", "to_ids": true, "type": "url", "uuid": "846c22a4-dda2-4637-a079-85804d2ff779", "value": "https://icky-lyrical.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784435989", "to_ids": true, "type": "url", "uuid": "eaaf337a-8ccf-4335-8f09-acdc5cb4617f", "value": "https://icky-lyrical.com/api/download?access_code=", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436010", "to_ids": true, "type": "url", "uuid": "2195d10c-da1b-4010-a2c6-b6e43b8d2536", "value": "https://icky-lyrical.com/storage/secure/Cohezo/windows/small/69cf7d0ea7cfd/cohezo_setup.msi", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436031", "to_ids": true, "type": "url", "uuid": "90d811a1-1edc-4dc6-ae20-f9f99097b3ac", "value": "https://icky-lyrical.com/storage/secure/werkbit/mac", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436052", "to_ids": true, "type": "url", "uuid": "88effcc1-b6f3-4c1e-a133-93e744261ed7", "value": "https://werkbit.io", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436073", "to_ids": true, "type": "url", "uuid": "5e42dc38-4319-43cb-bcf4-21e249058524", "value": "https://werknova.co/calendar/90f99c64-9fcc-451c-bae1-0b095c04e5c8", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436094", "to_ids": true, "type": "domain", "uuid": "6494e92b-c5c6-41d9-a7cd-aee74a2b7dd7", "value": "cohezo.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436115", "to_ids": true, "type": "domain", "uuid": "a87b6017-06b6-4aac-8996-345017afffc2", "value": "collabox.uk", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436136", "to_ids": true, "type": "domain", "uuid": "d6f793ba-d26b-4144-872f-f1d53a408ee1", "value": "cordinex.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436157", "to_ids": true, "type": "domain", "uuid": "a9db6d10-11df-465a-80b9-d9c33fa47f79", "value": "icky-lyrical.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436178", "to_ids": true, "type": "url", "uuid": "7f8bbace-d6de-4b81-b620-12b95a36e607", "value": "Werkbit.app/Contents/MacOS/veltod", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436199", "to_ids": true, "type": "url", "uuid": "20189645-6715-4ee4-9cb5-4cbdbe322d25", "value": "https://github.com/mgothiclove/pkeys/blob/main/sys.cache", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436220", "to_ids": true, "type": "url", "uuid": "81a29128-2999-43b2-99e1-374af08e05f2", "value": "https://raw.githubusercontent.com/mgothiclove/pkeys/main/sys.cache", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436242", "to_ids": true, "type": "domain", "uuid": "cf3fae9e-1013-45df-8c95-d320febc176e", "value": "synerix.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436263", "to_ids": true, "type": "url", "uuid": "c13f41ee-055f-437a-9d31-0c7603097546", "value": "https://synerix.app/calendar/144f20fc-c7fb-4e58-9544-75fe9099b61c", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436284", "to_ids": true, "type": "url", "uuid": "e6639b96-d79d-4acb-9c36-c09a0e3c98c4", "value": "https://synerix.app/calendar/a711f30b-b9bc-4f31-9c8e-869e7c1b2c1f", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784436305", "to_ids": true, "type": "ip-dst", "uuid": "a4cf08b5-39dc-4ff6-ae9d-5e95638c40d4", "value": "179.43.166.242", "Tag": [ { "colour": "#be4b17", "local": false, "name": "asn:asn=\"51852\"", "relationship_type": "" }, { "colour": "#39e6e7", "local": false, "name": "asn:as-owner=\"PLI-AS\"", "relationship_type": "" }, { "colour": "#5a7dcf", "local": false, "name": "asn:as-country=\"PA\"", "relationship_type": "" }, { "colour": "#f31b7b", "local": false, "name": "misp-galaxy:country=\"panama\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436326", "uuid": "42aee867-73d2-4a7b-ba5c-c6a59799ad9a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "md5", "timestamp": "1784436326", "to_ids": true, "type": "md5", "uuid": "8fbeef0c-36c4-4b61-a746-c257ccce0d24", "value": "ed33a3c8d9e861515623a73b27ea4913", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "sha1", "timestamp": "1784434528", "to_ids": true, "type": "sha1", "uuid": "b56c402a-967f-4462-82f0-4c18af3271e3", "value": "8063358813c37992cfe3fcd92038a0334c14353d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "sha256", "timestamp": "1784434528", "to_ids": true, "type": "sha256", "uuid": "df815837-ffdd-4e04-9f11-f73be26f39b4", "value": "3a9d703ba7f7564399365db7ab8b04238806ef7a53df0b6822f32b80bf0f5a80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "text", "timestamp": "1784433541", "to_ids": false, "type": "text", "uuid": "2ffc76f6-5635-48c1-8183-ab5f1b42e626", "value": "Type Description: Macintosh Disk Image\nVerified: Revoked\nSigners: Emil Grigorov; Apple Inc.; Apple Inc.\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2026-07-01T21:18:35+00:00\nLast Submission: 2026-07-14T04:20:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "ssdeep", "timestamp": "1784433541", "to_ids": true, "type": "ssdeep", "uuid": "44191350-b674-4ae0-89c2-abed8daf847c", "value": "393216:QEu2qh6bZtNqkGArlrYCmIC8i73dfQs78Sah8/LsmaSMip:pu2lbZ/9BbmL8ibLehMgma0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433541", "to_ids": false, "type": "size-in-bytes", "uuid": "a18bbec2-88a8-4736-b35c-ea1023acf3a7", "value": "14017636" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "vhash", "timestamp": "1784433541", "to_ids": true, "type": "vhash", "uuid": "030352b2-bf6a-43a0-8bc8-a3b0f5cada5c", "value": "70b85542efd05f6756a19660a09e6b63" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T21:18:35+00:00", "last_seen": "2026-07-14T04:20:59+00:00", "object_relation": "filename", "timestamp": "1784433541", "to_ids": true, "type": "filename", "uuid": "1ef98c87-5cdb-4b13-b13f-77073761bf53", "value": "dev.golove.velto" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436347", "uuid": "8e88246f-6217-4242-b3ef-948bbf8df998", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "md5", "timestamp": "1784436347", "to_ids": true, "type": "md5", "uuid": "f9d19094-3ddd-4527-9747-5e566fef5080", "value": "004b9f687e91c32cd35d52cffdbaf41c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "sha1", "timestamp": "1784434529", "to_ids": true, "type": "sha1", "uuid": "5f1523dc-82c5-4bb5-bca5-719170231fa0", "value": "632518d246fb3db36935d8f09f5fff9b179f7f63", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "sha256", "timestamp": "1784434529", "to_ids": true, "type": "sha256", "uuid": "4b508254-f8e8-4c25-becd-29965bea0590", "value": "08801f81960cd8c1077b4aa2e8124840d56a272842fdcc73263c9968e787e0bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "text", "timestamp": "1784433563", "to_ids": false, "type": "text", "uuid": "ba0e4cd9-3325-41a3-98ee-6cfc9a861784", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/CrashStealer.Z!MTB\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-29T15:17:00+00:00\nLast Submission: 2026-06-29T15:17:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "ssdeep", "timestamp": "1784433563", "to_ids": true, "type": "ssdeep", "uuid": "020e1f08-4375-4d05-8b2c-04633f310bc4", "value": "49152:yX1cw3nzn9ISZ6lWn7gElSWHjlzf9XHBsn6kYKsC5q7hk5L67+oTTDVHkhIlXZ7f:iIwBb3WR47+sHkhI3kl0a8M7MzbUjdkn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433563", "to_ids": false, "type": "size-in-bytes", "uuid": "2c33a6c6-12fd-44b2-adb0-e05437faf4bf", "value": "6155899" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "vhash", "timestamp": "1784433563", "to_ids": true, "type": "vhash", "uuid": "4e4bdf41-eb6a-45b3-837b-4e5229c786ff", "value": "1e2d2653835522d778681f49867996ed" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T15:17:00+00:00", "last_seen": "2026-06-29T15:17:00+00:00", "object_relation": "filename", "timestamp": "1784433563", "to_ids": true, "type": "filename", "uuid": "076f6a80-256b-4454-a9cc-a3e26f1223cb", "value": "main-arm64.out" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436368", "uuid": "e76bd408-4be6-438c-ae19-75c313ae0586", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "md5", "timestamp": "1784436368", "to_ids": true, "type": "md5", "uuid": "5fd9be82-2809-4c76-87f0-6bf52ea248a2", "value": "4264d6f6f775565b95578d6a3e88ceb5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "sha1", "timestamp": "1784434530", "to_ids": true, "type": "sha1", "uuid": "c0a97e7a-8342-438e-82fe-5af6c0333bad", "value": "b9f19c72dea18899c133d256dfad425a3b4c5789", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "sha256", "timestamp": "1784434530", "to_ids": true, "type": "sha256", "uuid": "1faeae00-8cc5-4412-bfb2-48c143fe2164", "value": "09bd60ce11ee4324e2052a439a08676e31aac787edda3f9bd02325390b5db2d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "text", "timestamp": "1784433585", "to_ids": false, "type": "text", "uuid": "367114eb-a4ed-4994-806f-b30b5292ace5", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/CrashStealer.Z!MTB\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-07-02T21:40:34+00:00\nLast Submission: 2026-07-02T21:40:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "ssdeep", "timestamp": "1784433585", "to_ids": true, "type": "ssdeep", "uuid": "a9b459e9-df93-4eb4-9c53-f25021fad348", "value": "98304:ybfVofD9HMNF6TEI8ltsdcFg5rMqQlyaN6c35iCORVT:gq7RTF8lts+Fg5Inymr5i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433585", "to_ids": false, "type": "size-in-bytes", "uuid": "a9059386-590c-4fd6-97be-25ead4d4294f", "value": "6370768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "vhash", "timestamp": "1784433585", "to_ids": true, "type": "vhash", "uuid": "548a0e8d-2a9b-4121-9799-2c01825694c7", "value": "c20c92a97b7327d6b885841e09dce88d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T21:40:34+00:00", "last_seen": "2026-07-02T21:40:34+00:00", "object_relation": "filename", "timestamp": "1784433585", "to_ids": true, "type": "filename", "uuid": "c38a5c41-084a-44e7-800c-73571b7e0b6e", "value": "com.apple.crashreporter" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436389", "uuid": "6e235cf8-67f4-4707-bfd6-079a33b981d7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "md5", "timestamp": "1784436389", "to_ids": true, "type": "md5", "uuid": "5aeca452-0a2f-4250-9179-b27346eda20d", "value": "b17471a9aa8a532e9540de31df215e2c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "sha1", "timestamp": "1784434531", "to_ids": true, "type": "sha1", "uuid": "d0f6cfba-a59f-4097-9b79-08803daf8e59", "value": "4bab15269f873ecb3f502ba11c33dbb4fafc9dfc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "sha256", "timestamp": "1784434531", "to_ids": true, "type": "sha256", "uuid": "c2a2c14c-d7f7-4b82-9a34-d0646c5c920c", "value": "4ed199e27a4dc193468569b221b19180e5ae95cab8df84d92e082b68d33672f5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "text", "timestamp": "1784433606", "to_ids": false, "type": "text", "uuid": "30623a13-9adb-4b7d-8531-faec137720e2", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/CrashStealer.Z!MTB\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-07-01T15:34:44+00:00\nLast Submission: 2026-07-01T15:34:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "ssdeep", "timestamp": "1784433606", "to_ids": true, "type": "ssdeep", "uuid": "07674c66-3b02-4009-bcd0-c56b5f7449ee", "value": "98304:sbfVofD9HMNFqTEI8ltsdcFg5rMqQlyaN6c35iCOR:mq7BTF8lts+Fg5Inymr5i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433606", "to_ids": false, "type": "size-in-bytes", "uuid": "7078c22d-a2e1-4051-8c43-ee73a9072b05", "value": "6352240" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "vhash", "timestamp": "1784433606", "to_ids": true, "type": "vhash", "uuid": "2df1113f-acd1-4c87-9419-4e49596c83b6", "value": "c20c92a97b7327d6b885841e09dce88d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T15:34:44+00:00", "last_seen": "2026-07-01T15:34:44+00:00", "object_relation": "filename", "timestamp": "1784433606", "to_ids": true, "type": "filename", "uuid": "f427886f-c013-4394-965f-4ea9c213de58", "value": "com.apple.crashreporter" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436410", "uuid": "fbb1ddae-fab7-401d-8bc2-c275d4ff78a8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "md5", "timestamp": "1784436410", "to_ids": true, "type": "md5", "uuid": "187cc074-3062-44c3-95db-1d8c8e6e1955", "value": "588ebbe16593cdd13a0b9f4e77a9b513", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "sha1", "timestamp": "1784434534", "to_ids": true, "type": "sha1", "uuid": "ce1805db-ef42-49c8-9cf3-866d8ffc5295", "value": "d230794982325afae687aef0a5245e50c7530539", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "sha256", "timestamp": "1784434534", "to_ids": true, "type": "sha256", "uuid": "b9e392d7-6f38-4afe-b8e3-9f12bc989502", "value": "81ef05cc4d07cd22cd7cd7099f278dd9b9a3ae8ad4770b3d387892e1c6cfb7d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "text", "timestamp": "1784433649", "to_ids": false, "type": "text", "uuid": "46aa7f9c-2d42-41b7-a884-b3f887c57e28", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/CrashStealer.Z!MTB\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-07-02T21:41:16+00:00\nLast Submission: 2026-07-17T04:08:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "ssdeep", "timestamp": "1784433649", "to_ids": true, "type": "ssdeep", "uuid": "c0e750cc-3869-448b-b1fe-3666a471c714", "value": "49152:2Y1dit9qTRlEltsd3srvRg5rMqQlyt0NtYc35iCORVTJ:nTEI8ltsdcFg5rMqQlyaN6c35iCORVT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433649", "to_ids": false, "type": "size-in-bytes", "uuid": "584b3ac3-6d32-4c91-ae08-acda055ed613", "value": "3208656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "vhash", "timestamp": "1784433649", "to_ids": true, "type": "vhash", "uuid": "7c822436-ea3a-45d3-810b-fab154ef6863", "value": "2eeb6201ad952ffe0e3d8dc19a66749e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T21:41:16+00:00", "last_seen": "2026-07-17T04:08:00+00:00", "object_relation": "filename", "timestamp": "1784433649", "to_ids": true, "type": "filename", "uuid": "8ad98aaa-f1c5-4c67-a3d1-4ce18846c588", "value": "com.apple.crashreporter" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436432", "uuid": "9c450e20-b956-449e-8a7d-b573d19a714e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "md5", "timestamp": "1784436432", "to_ids": true, "type": "md5", "uuid": "d7f87e7f-3e8e-4bbd-a231-5ddfb9ab98f6", "value": "937c29aa81b6a47497b9019e68a81211", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "sha1", "timestamp": "1784434535", "to_ids": true, "type": "sha1", "uuid": "0c920c28-038a-4db4-b6e1-61713a13a1e7", "value": "945f9500f8a318909609c261846eb916807c3f1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "sha256", "timestamp": "1784434535", "to_ids": true, "type": "sha256", "uuid": "eaed0edd-52e6-4fac-829f-11a6b0debb8b", "value": "a1966a6d6f54a025f30d55571d21d6537977ca73ffa734c13494b9c806cd7007", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "text", "timestamp": "1784433691", "to_ids": false, "type": "text", "uuid": "dbe9abe6-86f3-4075-a13b-4e135288434f", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/CrashStealer.Z!MTB\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-07-01T15:35:08+00:00\nLast Submission: 2026-07-17T11:05:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "ssdeep", "timestamp": "1784433691", "to_ids": true, "type": "ssdeep", "uuid": "1efc435a-da3b-4d5a-83fe-3a1d97860959", "value": "49152:6Y1dit9qTRlEltsd3srvRg5rMqQlyt0NtYc35iCOR:zTEI8ltsdcFg5rMqQlyaN6c35iCOR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433691", "to_ids": false, "type": "size-in-bytes", "uuid": "731fc88f-6810-4727-8f6f-6615c9fcbc8b", "value": "3190128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "vhash", "timestamp": "1784433691", "to_ids": true, "type": "vhash", "uuid": "f0e01e0d-3f56-4426-a9d3-7c5cba1dd6ea", "value": "2eeb6201ad952ffe0e3d8dc19a66749e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-01T15:35:08+00:00", "last_seen": "2026-07-17T11:05:32+00:00", "object_relation": "filename", "timestamp": "1784433691", "to_ids": true, "type": "filename", "uuid": "a909a2d6-4bde-4e07-9a1d-7a3aae91d9a6", "value": "com.apple.crashreporter" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436453", "uuid": "0cfbe201-9be8-4fdc-b635-57704b127388", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "md5", "timestamp": "1784436453", "to_ids": true, "type": "md5", "uuid": "a78c68cf-e2d7-4c8c-a6cd-3a834d13e4cd", "value": "7124a84941519e6adaf2f64d59571197", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "sha1", "timestamp": "1784434537", "to_ids": true, "type": "sha1", "uuid": "4dc130ba-0a6c-4930-8b1f-047d4796d6f8", "value": "24b9e7263852436d9d5ac6c2521d3174b8e76fb5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "sha256", "timestamp": "1784434537", "to_ids": true, "type": "sha256", "uuid": "87f32128-e977-4d7b-a9b3-6f2688407156", "value": "f3857c0b84a24b7fc912d55f8b14c67c23d5837b1a6932164d5d62273d4affeb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "text", "timestamp": "1784433713", "to_ids": false, "type": "text", "uuid": "6906fb9a-1ef8-4331-9384-7caf4bdb9b4e", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:JS/IceCubeStealer!MTB\nClamAV: None\nVT Total Detection: 17/74\nFirst Submission: 2026-05-19T08:13:36+00:00\nLast Submission: 2026-05-19T08:13:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "ssdeep", "timestamp": "1784433713", "to_ids": true, "type": "ssdeep", "uuid": "84e0d680-fdcf-4014-a5b9-ba8762a31baa", "value": "98304:vpegvRsMSsRSougqeX8CYdv0U1RpWDlAB1Q2:pv2MS6+mYp9Bm2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433713", "to_ids": false, "type": "size-in-bytes", "uuid": "2edaf8b0-7414-4e11-b023-1efa3a8e6c99", "value": "3370573" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "vhash", "timestamp": "1784433713", "to_ids": true, "type": "vhash", "uuid": "e9cdd17e-46cd-40e6-a894-770277c83526", "value": "e109ea8b73363bfac36cf9f16dc53f5e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:13:36+00:00", "last_seen": "2026-05-19T08:13:36+00:00", "object_relation": "filename", "timestamp": "1784433713", "to_ids": true, "type": "filename", "uuid": "c7a0b4f3-28c3-4ff1-b0ec-9f65f7d96409", "value": "main-arm64.out" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784436474", "uuid": "220c71ec-8d2d-4487-81d4-f360f3382515", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "md5", "timestamp": "1784436474", "to_ids": true, "type": "md5", "uuid": "33446815-40e6-40a2-984c-468a11966e49", "value": "651c5215b721bfae80e910e38122fb31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "sha1", "timestamp": "1784434538", "to_ids": true, "type": "sha1", "uuid": "8c6a3c8e-79e6-4871-86d3-c539552577f0", "value": "b9a66654ba21548b25391c251c90d29018096195", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "sha256", "timestamp": "1784434538", "to_ids": true, "type": "sha256", "uuid": "fc80cd53-cb73-48a0-8644-00f7320048ae", "value": "fba5bbe87fa351eedf2f3c16653cc9e4196d73604529bb50a609e2d3ebf1828b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "text", "timestamp": "1784433734", "to_ids": false, "type": "text", "uuid": "4b7c33c5-99ed-4844-b82d-324b0b1b7e37", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Infostealer.J\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-05-19T08:33:47+00:00\nLast Submission: 2026-05-19T08:33:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "ssdeep", "timestamp": "1784433734", "to_ids": true, "type": "ssdeep", "uuid": "629bcf47-10dc-4374-bf0a-b95f45c97f45", "value": "98304:z7U8tGqOEKOo188Sw+f4iW6DRxDHb93MphODjPSmJLVBO7lo6:/UpEKOk1+f4iW6DRxDHb9ghOfPSz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784433734", "to_ids": false, "type": "size-in-bytes", "uuid": "90e84c8c-f829-4970-9f13-0452ba8e21af", "value": "5875307" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "vhash", "timestamp": "1784433734", "to_ids": true, "type": "vhash", "uuid": "263a335a-bca4-4ed8-8fbf-32909c2e5768", "value": "8dfce437e32e4fd538a78040bea2a00a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:33:47+00:00", "last_seen": "2026-05-19T08:33:47+00:00", "object_relation": "filename", "timestamp": "1784433734", "to_ids": true, "type": "filename", "uuid": "a22e2c00-1636-492b-918e-77ced6a75f2a", "value": "main-arm64.out" } ] } ] } }