{ "Event": { "analysis": "1", "date": "2026-07-09", "extends_uuid": "", "info": "[Threat Intel] GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware", "protected": false, "publish_timestamp": "1784349320", "published": true, "threat_level_id": "2", "timestamp": "1784349320", "uuid": "d79809eb-075a-4d05-b866-52a5f2aae52a", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#96f4f6", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#343cd4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"VNC - T1021.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#b2a633", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#d82db7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#a05856", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disk Content Wipe - T1561.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Shutdown/Reboot - T1529\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681206", "to_ids": false, "type": "link", "uuid": "e7f432ba-8daa-40a4-8831-8dfffd23e0d7", "value": "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783681206", "to_ids": false, "type": "text", "uuid": "edb6584c-d23d-4a5f-8ae7-02470a358163", "value": "In October 2025, Microsoft Threat Intelligence discovered GigaWiper, a sophisticated Golang-based backdoor that combines command-and-control capabilities with multiple destructive payloads. This versatile implant consolidates functionality from at least three separate malware families: a standalone wiper operating at physical disk level, a destructive component derived from Crucio ransomware that encrypts files with randomly generated unsaved keys, and a reimplemented version of FlockWiper with enhanced multi-pass secure wiping. The backdoor provides 20 different commands enabling threat actors to maintain control, execute operations, collect system information, and trigger destructive actions on demand. GigaWiper establishes persistence through scheduled tasks, communicates via RabbitMQ and Redis servers, and can perform disk wiping, fake ransomware encryption, screen recording, VNC-like remote control, and system-level sabotage including BSOD triggers and event log clearing." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783681206", "to_ids": false, "type": "text", "uuid": "0e126feb-193a-42eb-9e52-e8630841de44", "value": "Name: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware\nAuthor: AlienVault\nAdversary: \nTags: [\"multi-stage intrusion\", \"wprcree\", \"flockwiper\", \"destructive wiper\", \"crucio\", \"gigawiper\", \"fake ransomware\", \"rabbitmq\", \"wprflock\", \"cutbrooch\", \"disk wiping\", \"golang backdoor\"]\nTgtd countries: []\nMlwr families: [\"GigaWiper\", \"Crucio\", \"FlockWiper\", \"WprFlock\", \"WprCree\", \"CutBrooch\"]\nAttack_ids: [\"T1021.005\", \"T1113\", \"T1033\", \"T1056.001\", \"T1489\", \"T1543.003\", \"T1082\", \"T1112\", \"T1070.001\", \"T1016\", \"T1083\", \"T1057\", \"T1059.001\", \"T1486\", \"T1012\", \"T1518.001\", \"T1485\", \"T1490\", \"T1561.001\", \"T1529\"]\nIndustries: []" }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS49981 worldstream b.v.", "deleted": false, "disable_correlation": false, "timestamp": "1784348242", "to_ids": true, "type": "ip-dst", "uuid": "de2a8f03-431a-4805-b450-adbd2db675fd", "value": "212.8.248.104", "Tag": [ { "colour": "#d4116f", "local": false, "name": "asn:asn=\"49981\"", "relationship_type": "" }, { "colour": "#ae528b", "local": false, "name": "asn:as-owner=\"WORLDSTREAM\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS49981 worldstream b.v.", "deleted": false, "disable_correlation": false, "timestamp": "1784348263", "to_ids": true, "type": "ip-dst", "uuid": "a707059a-ee5e-4a56-b004-f54946d0de44", "value": "185.182.193.21", "Tag": [ { "colour": "#d4116f", "local": false, "name": "asn:asn=\"49981\"", "relationship_type": "" }, { "colour": "#ae528b", "local": false, "name": "asn:as-owner=\"WORLDSTREAM\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348284", "uuid": "6168094c-8cad-4787-b61f-45bf32cd3e0f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "md5", "timestamp": "1784348284", "to_ids": true, "type": "md5", "uuid": "6bc93268-54cf-4535-87d9-35dfa270c551", "value": "ba284a4b508a7abd8070a427386e93e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "sha1", "timestamp": "1784344594", "to_ids": true, "type": "sha1", "uuid": "86d3e3c2-bb39-4deb-81ee-d2b658ad49b6", "value": "66ae21571faee1e258549078144325dc9dd60303", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "sha256", "timestamp": "1784344594", "to_ids": true, "type": "sha256", "uuid": "abd323b5-28f6-4d18-b3bd-f5a0de6ec127", "value": "440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "text", "timestamp": "1784343003", "to_ids": false, "type": "text", "uuid": "f86f281a-6d97-47b6-a0ae-9e72b60d44f2", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Seheq!rfn\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2023-10-29T15:26:57+00:00\nFirst Submission: 2026-07-08T11:38:51+00:00\nLast Submission: 2026-07-15T15:10:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "ssdeep", "timestamp": "1784343003", "to_ids": true, "type": "ssdeep", "uuid": "bc661ef9-9d55-49b4-8b6f-bd1318d6fd6e", "value": "98304:qiSsFP9OSEvCX3xJdAJtk+jWa88QbHQj:qM+aHjdAJ2+jWaXQrQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343003", "to_ids": false, "type": "size-in-bytes", "uuid": "adbb45da-8248-485c-8e01-830252e27101", "value": "6428672" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "vhash", "timestamp": "1784343003", "to_ids": true, "type": "vhash", "uuid": "fc46a292-bb72-4244-8361-658bd1e7763a", "value": "0660d6655d55557575157az27!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T11:38:51+00:00", "last_seen": "2026-07-15T15:10:20+00:00", "object_relation": "filename", "timestamp": "1784343003", "to_ids": true, "type": "filename", "uuid": "f1cc5a16-6b21-497d-90ed-e5f2ab5959ea", "value": "440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348305", "uuid": "c0bf650e-6050-47b6-b950-4cf2f5a098a3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "md5", "timestamp": "1784348305", "to_ids": true, "type": "md5", "uuid": "027b99f1-fa88-46a1-84bd-9c7a417fb40f", "value": "6093afce53d56355dbabb43f2bbd2085", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "sha1", "timestamp": "1784344594", "to_ids": true, "type": "sha1", "uuid": "c0b3d7ce-a10b-4f55-9536-1dd14c84a052", "value": "5dafc3de9a0b6726ba5e6231fe502fb92a87d057", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "sha256", "timestamp": "1784344595", "to_ids": true, "type": "sha256", "uuid": "565b69ac-31e3-429c-aa3e-3c4d8ffe4a74", "value": "12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "text", "timestamp": "1784343025", "to_ids": false, "type": "text", "uuid": "cbba3d93-250d-4ec1-b23a-51d47a67e46b", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/WprCree.A!dha\nClamAV: None\nVT Total Detection: 55/74\nFirst Seen In The Wild: 2025-06-19T15:54:04+00:00\nFirst Submission: 2025-06-19T11:42:41+00:00\nLast Submission: 2026-04-28T10:05:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "creation-time", "timestamp": "1784343025", "to_ids": false, "type": "datetime", "uuid": "6ca40ecb-195a-4b44-8014-fa964d34b524", "value": "2025-06-16T17:03:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "ssdeep", "timestamp": "1784343025", "to_ids": true, "type": "ssdeep", "uuid": "db3932f4-c3be-428c-bc8f-10ba6eb629b5", "value": "384:qYUxZ/lUQ0DeLYpf0uJOyCgTP82jk4++139cM870fZ:qAQmqnyCRkkf49c/70x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343025", "to_ids": false, "type": "size-in-bytes", "uuid": "2152db4f-d13e-4430-9629-66183c3bce83", "value": "20480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "vhash", "timestamp": "1784343025", "to_ids": true, "type": "vhash", "uuid": "0c16258c-1d33-47f8-b064-52fcd53a948a", "value": "024056651d15556az11wz16z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-19T11:42:41+00:00", "last_seen": "2026-04-28T10:05:49+00:00", "object_relation": "filename", "timestamp": "1784343025", "to_ids": true, "type": "filename", "uuid": "61b19db4-44ba-4b3a-8742-a92aadf0bd09", "value": "sample.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348326", "uuid": "198454ab-0e1a-4e89-9bb3-f3c80fef8c4a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "md5", "timestamp": "1784348326", "to_ids": true, "type": "md5", "uuid": "366b20cc-446d-47db-9630-8352b9316cec", "value": "7c76e51390b0d2e2759fad5ccee2bc30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "sha1", "timestamp": "1784344596", "to_ids": true, "type": "sha1", "uuid": "7388c632-2d8a-40b5-a116-55082d619063", "value": "b91be21e984407529691edb1bfe3f97dd4a1ae24", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "sha256", "timestamp": "1784344596", "to_ids": true, "type": "sha256", "uuid": "a1fe4d7f-8aab-49f9-b020-28f1f86aaac9", "value": "db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "text", "timestamp": "1784343047", "to_ids": false, "type": "text", "uuid": "110106ba-19f3-4cfa-892b-d00a57da8b60", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/WprFlock.B!dha\nClamAV: None\nVT Total Detection: 45/74\nFirst Seen In The Wild: 2026-07-09T17:01:07+00:00\nFirst Submission: 2026-04-05T05:52:11+00:00\nLast Submission: 2026-05-27T07:17:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "creation-time", "timestamp": "1784343047", "to_ids": false, "type": "datetime", "uuid": "c4260f40-9d8d-4b6d-88b3-e39175482746", "value": "2026-04-03T14:06:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "ssdeep", "timestamp": "1784343047", "to_ids": true, "type": "ssdeep", "uuid": "ee57c0b2-6f28-45e9-b20f-dcda39b4a0c6", "value": "3072:0Ok/xmqDdeQwFDRCaDUGI//S4CYElBv5RVr/BEZyvUJQ4j6ySZHTky6Dj3d:01mqEPCawbnhRElzRx/BEZPjmzwN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343047", "to_ids": false, "type": "size-in-bytes", "uuid": "311bd76d-e32b-4c77-bda9-14ae6ec777c3", "value": "224256" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "vhash", "timestamp": "1784343047", "to_ids": true, "type": "vhash", "uuid": "257677e7-cece-48ae-80a4-072f83591d27", "value": "025066655d1d05556038z52!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-05T05:52:11+00:00", "last_seen": "2026-05-27T07:17:42+00:00", "object_relation": "filename", "timestamp": "1784343047", "to_ids": true, "type": "filename", "uuid": "f6b9c3a8-5b06-4ef0-9202-92647c0b001c", "value": "db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348347", "uuid": "b4fee675-d728-405f-bdb0-a4121a081a7e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "md5", "timestamp": "1784348347", "to_ids": true, "type": "md5", "uuid": "1291a33f-f522-433c-b989-edd263313918", "value": "a9dbe0025975e3fa764376a437043963", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "sha1", "timestamp": "1784344597", "to_ids": true, "type": "sha1", "uuid": "37870d92-9316-4879-b5bc-287dbe66cf2e", "value": "d2815fe279a904b0f13356df58b8a06f8c6babe0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "sha256", "timestamp": "1784344597", "to_ids": true, "type": "sha256", "uuid": "f8e62ca2-9f87-436a-a800-45e154937cd4", "value": "633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "text", "timestamp": "1784343068", "to_ids": false, "type": "text", "uuid": "7e914b2d-9100-46c4-b1dd-83f334b97a22", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/GigaWiper.A!dha\nClamAV: Win.Trojan.Zebrocy-6808822-0\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2026-03-19T20:22:40+00:00\nFirst Submission: 2026-03-19T13:28:32+00:00\nLast Submission: 2026-07-09T18:35:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "ssdeep", "timestamp": "1784343068", "to_ids": true, "type": "ssdeep", "uuid": "4c4d6ab1-5585-4b15-bd77-b630a9ad17f1", "value": "49152:HtYa/tXXYeMtiVb6DCpVDiR3sWy5vXtd6GJnMlio8mO+xDZ8eCEc8U3nkGvCBdrS:H5XFNgsPNn3nuOMIrNEbzd3CY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343068", "to_ids": false, "type": "size-in-bytes", "uuid": "83bb8d2b-408c-478f-94a4-7233e66369b3", "value": "10412544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "vhash", "timestamp": "1784343068", "to_ids": true, "type": "vhash", "uuid": "954c9e17-c048-4071-9230-143b9708e795", "value": "0170b66d5555551c051517z7003a27kz19ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T13:28:32+00:00", "last_seen": "2026-07-09T18:35:22+00:00", "object_relation": "filename", "timestamp": "1784343068", "to_ids": true, "type": "filename", "uuid": "fbeb666d-0b35-4732-b4f3-61873916ee2f", "value": "Adobe.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348368", "uuid": "d2046ddd-1ae7-4e98-9c28-01ecc2be011f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "md5", "timestamp": "1784348368", "to_ids": true, "type": "md5", "uuid": "0a1871cc-5420-47a9-bc50-3a20f3b7e81c", "value": "be1082aac756fbf3ad7f41c1bc5b9eec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "sha1", "timestamp": "1784344598", "to_ids": true, "type": "sha1", "uuid": "9e42a3ac-38b7-485e-9ea1-bb21f42cb528", "value": "6f0370309e8cae19e83fbff6f08c1ece3b17b642", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "sha256", "timestamp": "1784344598", "to_ids": true, "type": "sha256", "uuid": "f32d63a1-fcd3-48db-95c5-42a6d69ee75d", "value": "f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "text", "timestamp": "1784343090", "to_ids": false, "type": "text", "uuid": "654f1696-a0c5-4b57-bc28-5680cd85b4d3", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/GigaWiper.A!dha\nClamAV: Win.Trojan.Zebrocy-6808822-0\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-03-19T11:20:08+00:00\nFirst Submission: 2026-03-19T10:03:41+00:00\nLast Submission: 2026-03-31T21:17:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "ssdeep", "timestamp": "1784343090", "to_ids": true, "type": "ssdeep", "uuid": "5f637422-8050-47eb-8032-27090b09b1a4", "value": "49152:RtYa/tXXYeMtiVb6DCpVDiR3sWy5vXtd6GJnMlio8mO+xDZ8eCEc8U3nkGvCBdrf:R5XFNgsPNn3nuOMIrNEbGd3CY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343090", "to_ids": false, "type": "size-in-bytes", "uuid": "b5708b6b-4605-49ad-abc1-1013ac911882", "value": "10412544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "vhash", "timestamp": "1784343090", "to_ids": true, "type": "vhash", "uuid": "2ce68b2e-58ad-4d67-ac1f-5baa957b7ee1", "value": "0170b66d5555551c051517z7003a27kz19ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T10:03:41+00:00", "last_seen": "2026-03-31T21:17:54+00:00", "object_relation": "filename", "timestamp": "1784343090", "to_ids": true, "type": "filename", "uuid": "6f5453ea-2ba7-4979-9762-6fa3e07790a2", "value": "63679c56_Win.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348389", "uuid": "ee0e9850-7f65-4838-a86b-ee4bbe2bed30", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "md5", "timestamp": "1784348389", "to_ids": true, "type": "md5", "uuid": "b20b5841-4dd4-4877-9600-10d825e7626e", "value": "62bcb76113ea745020f5e68c8ce9f283", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "sha1", "timestamp": "1784344599", "to_ids": true, "type": "sha1", "uuid": "d73c314e-afe3-4ce9-805c-3a48bee94df5", "value": "35953ddaa42da7c71f3efd40d24cf91209c6c473", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "sha256", "timestamp": "1784344599", "to_ids": true, "type": "sha256", "uuid": "b1f24eb1-7642-49ab-95d2-5c64ada053d9", "value": "ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "text", "timestamp": "1784343112", "to_ids": false, "type": "text", "uuid": "5833e2ea-166f-435c-8c1c-b7e1799d28a4", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/GigaWiper.A!dha\nClamAV: Win.Trojan.Zebrocy-6808822-0\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-03-21T05:56:21+00:00\nFirst Submission: 2026-03-19T13:44:51+00:00\nLast Submission: 2026-03-19T16:47:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "ssdeep", "timestamp": "1784343112", "to_ids": true, "type": "ssdeep", "uuid": "30575d21-1942-4534-bb00-ce5d477cc584", "value": "49152:dtYa/tXXYeMtiVb6DCpVDiR3sWy5vXtd6GJnMlio8mO+xDZ8eCEc8U3nkGvCBdrW:d5XFNgsPNn3nuOMIrNEbPd3CY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343112", "to_ids": false, "type": "size-in-bytes", "uuid": "8e3c58e2-77fb-4b20-8b3b-f0e31dbb45e5", "value": "10412544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "vhash", "timestamp": "1784343112", "to_ids": true, "type": "vhash", "uuid": "39c22455-0bf9-43fa-950e-207f25feff8e", "value": "0170b66d5555551c051517z7003a27kz19ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-19T13:44:51+00:00", "last_seen": "2026-03-19T16:47:42+00:00", "object_relation": "filename", "timestamp": "1784343112", "to_ids": true, "type": "filename", "uuid": "e1be3fd1-81d0-4b22-8451-98bcfa319b38", "value": "chbx2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348410", "uuid": "6dfd0128-4b69-4443-b903-7e1939f7df2c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "md5", "timestamp": "1784348410", "to_ids": true, "type": "md5", "uuid": "f093c8ac-1ef6-458c-a236-2bfe3e987826", "value": "fbc2f83b75f3602a281fec095068ea34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "sha1", "timestamp": "1784344600", "to_ids": true, "type": "sha1", "uuid": "f35603fb-6fbd-451a-b988-67feb823a56f", "value": "9a518770de592df858659f85d2f1a7f10362c304", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "sha256", "timestamp": "1784344600", "to_ids": true, "type": "sha256", "uuid": "67fa4907-091a-4b06-ac2d-a05e7617e617", "value": "9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "text", "timestamp": "1784343133", "to_ids": false, "type": "text", "uuid": "3671fc62-7fcd-4b83-9ba0-36878064d93c", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/GigaWiper.A!dha\nClamAV: Win.Trojan.Zebrocy-6808822-0\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-03-17T23:58:38+00:00\nFirst Submission: 2026-03-17T21:57:27+00:00\nLast Submission: 2026-04-15T13:54:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "ssdeep", "timestamp": "1784343133", "to_ids": true, "type": "ssdeep", "uuid": "1e3302b9-2be6-487d-a699-28851225a33b", "value": "49152:q7oJeEZNIlb6eaKOm7nI9p4CE5aHf4KUfG8CGKzcBkD067/jHZX9WlnMEGwXwFES:q0MCp41VCGoofFXyEM1mMqkM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343133", "to_ids": false, "type": "size-in-bytes", "uuid": "d31c2344-6666-4adb-8ce8-ef0d98ef22a0", "value": "10507776" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "vhash", "timestamp": "1784343133", "to_ids": true, "type": "vhash", "uuid": "f9837b72-3cfc-457d-bdd4-f0e61208f448", "value": "0170b66d5555551c051557z7003c29kz19ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-17T21:57:27+00:00", "last_seen": "2026-04-15T13:54:49+00:00", "object_relation": "filename", "timestamp": "1784343133", "to_ids": true, "type": "filename", "uuid": "ac99126e-4b1a-47a6-a2c3-5435687047ea", "value": "SupportAssistance.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348431", "uuid": "d5f73f06-efdc-4699-8cda-fc743529bfae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "md5", "timestamp": "1784348431", "to_ids": true, "type": "md5", "uuid": "367c3046-a8f9-4269-b4af-685e19744093", "value": "d8e38aebecd969e7f3879265f4db46eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "sha1", "timestamp": "1784344601", "to_ids": true, "type": "sha1", "uuid": "bb95015f-1998-44df-9e77-be85e83e9905", "value": "d748f42691e10df5c5936d612b8d4b36ad06eed2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "sha256", "timestamp": "1784344602", "to_ids": true, "type": "sha256", "uuid": "e53cbeee-9b5f-4139-b502-095e0eef6522", "value": "3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "text", "timestamp": "1784343155", "to_ids": false, "type": "text", "uuid": "6b0a4bcc-dfa9-4ba2-80da-e0b6ffafe5ad", "value": "Type Description: Win32 EXE\nMicrosoft: DoS:Win32/GigaWiper.A!dha\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2026-04-05T12:47:41+00:00\nFirst Submission: 2026-04-04T22:31:30+00:00\nLast Submission: 2026-07-09T18:34:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "ssdeep", "timestamp": "1784343155", "to_ids": true, "type": "ssdeep", "uuid": "2f8948e5-2fef-4c4a-b969-fa805202a613", "value": "49152:0p2IFThFPmKfdAZVhfuU3BtF3o5eSu+TST7Wct5X:0p2KTbmVxt+eSu8S3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343155", "to_ids": false, "type": "size-in-bytes", "uuid": "1e7289e5-7b26-44af-9e0b-eb2784abfb32", "value": "3611648" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "vhash", "timestamp": "1784343155", "to_ids": true, "type": "vhash", "uuid": "fd9893be-8ffa-489a-a199-7141bc5e3e15", "value": "036106655d15551555757az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-04T22:31:30+00:00", "last_seen": "2026-07-09T18:34:44+00:00", "object_relation": "filename", "timestamp": "1784343155", "to_ids": true, "type": "filename", "uuid": "f0934948-bc16-4a2c-93fd-6c96250e50d1", "value": "PluginManager.exe" } ] } ] } }