{ "Event": { "analysis": "1", "date": "2026-07-21", "extends_uuid": "", "info": "[Threat Intel] Portugal-focused phishing campaign delivers multistage malware", "protected": false, "publish_timestamp": "1785577589", "published": true, "threat_level_id": "3", "timestamp": "1785577588", "uuid": "daf0a3db-a72f-464f-bd72-f1fd4d3c0cef", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#327a31", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Binary Padding - T1027.001\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#c70b8f", "local": false, "name": "misp-galaxy:target-information=\"Portugal\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#f439e5", "local": false, "name": "misp-galaxy:target-information=\"Spain\"", "relationship_type": "" }, { "colour": "#ce59f1", "local": false, "name": "misp-galaxy:target-information=\"United Kingdom\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"lampion\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784718012", "to_ids": false, "type": "link", "uuid": "7aa1bfa4-0094-49e5-b504-75684343df86", "value": "https://www.acronis.com/en/tru/posts/lampions-portugal-focused-phishing-campaign-delivers-multistage-malware/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784718012", "to_ids": false, "type": "text", "uuid": "10f94bf4-ca8c-42bf-a949-133ccb6a72dc", "value": "An active Lampion malware campaign has been identified targeting Portuguese users through phishing emails that impersonate financial and administrative communications. Lampion, a Brazilian banking malware derived from the ChePro lineage, delivers initial payloads via ZIP archives containing heavily obfuscated HTML files designed to evade detection. The HTML stage retrieves additional scripts from attacker-controlled infrastructure, initiating a multistage VBS infection chain. Each stage employs extensive obfuscation techniques including junk code, encrypted strings, and dynamically generated scripts that inflate file sizes while concealing core functionality. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis. Telemetry shows 94.6% of detections concentrated in Portugal, confirming this is a highly targeted threat focused on Portuguese-speaking victims." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784718012", "to_ids": false, "type": "text", "uuid": "4d6f8094-88cb-49ea-8349-06225b41ddcf", "value": "Name: Portugal-focused phishing campaign delivers multistage malware\nAuthor: AlienVault\nAdversary: \nTags: [\"phishing campaign\", \"banking trojan\", \"vbs infection chain\", \"obfuscation techniques\", \"lampion\", \"portuguese lures\", \"sapo impersonation\", \"portugal targeting\", \"chepro\"]\nTgtd countries: [\"Portugal\"]\nMlwr families: [\"Lampion\", \"ChePro\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1033\", \"T1218.011\", \"T1059.007\", \"T1204.002\", \"T1566.001\", \"T1082\", \"T1027.001\", \"T1497\", \"T1547.001\", \"T1027\", \"T1012\", \"T1518.001\", \"T1071.001\", \"T1059.005\", \"T1105\"]\nIndustries: [\"Finance\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785118391", "to_ids": true, "type": "url", "uuid": "bfe8dc02-b386-4443-9819-63b424758abc", "value": "https://fat-contabislitaca.com/js/1898.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785118412", "to_ids": true, "type": "domain", "uuid": "cc2abe76-07aa-4722-a3ea-7d9b033ff68e", "value": "auto-contabilistica.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785118433", "to_ids": true, "type": "domain", "uuid": "a3e41309-3eb5-462d-8c5f-43e6f6b5ff9b", "value": "autoridade-contabilistica.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785118454", "to_ids": true, "type": "domain", "uuid": "c23920b5-3bf0-4b21-a6a3-c77e4b09ded8", "value": "autoridade-financeira.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785118476", "to_ids": true, "type": "domain", "uuid": "96f03abf-1061-4315-80e1-f0f1fe1dbbd7", "value": "fat-contabislitaca.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118497", "to_ids": true, "type": "ip-dst", "uuid": "f4362173-490c-4113-b47c-e9d4ca671113", "value": "18.218.184.201", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118518", "to_ids": true, "type": "ip-dst", "uuid": "b476272d-7929-4d0c-a2f7-25b3dba1901e", "value": "18.222.100.142", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118539", "to_ids": true, "type": "ip-dst", "uuid": "b571da88-40f1-4faf-82c9-9cfc7ea553a9", "value": "3.135.194.95", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118561", "to_ids": true, "type": "ip-dst", "uuid": "2d97c714-ed1d-4f12-8c29-17cf1b32e364", "value": "3.139.85.102", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118582", "to_ids": true, "type": "ip-dst", "uuid": "319edc17-587d-4811-a404-4ec26a27277a", "value": "3.141.199.105", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118603", "to_ids": true, "type": "ip-dst", "uuid": "a9eae9cd-27fb-42fd-b66b-6507fc3a68fe", "value": "3.144.37.134", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118624", "to_ids": true, "type": "ip-dst", "uuid": "0517d5be-111f-47bc-9c40-3cb9d1dd5765", "value": "3.148.240.228", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118645", "to_ids": true, "type": "ip-dst", "uuid": "080bcb59-263c-43ae-8d20-b6fc7647f827", "value": "3.150.134.118", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118666", "to_ids": true, "type": "ip-dst", "uuid": "a4346e96-5083-4b35-aa41-9fb377d6c9ae", "value": "52.14.160.173", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118687", "to_ids": true, "type": "url", "uuid": "913e7e64-7c83-4ea2-8444-3a6f862a555d", "value": "http://18.218.184.201/03_metal7342/trapezio.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118709", "to_ids": true, "type": "url", "uuid": "5aad66e9-653d-4809-9896-2a9a8aec803d", "value": "http://18.222.100.142/17_moldura8210/regerem.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118730", "to_ids": true, "type": "url", "uuid": "1b448faa-8be8-417c-b689-6cc54472a0d3", "value": "http://18.222.100.142/18_prateleira1967/revigore.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118752", "to_ids": true, "type": "url", "uuid": "16765eb6-cb00-413f-856b-966f4662eada", "value": "http://3.135.194.95/09_nsabdo/receado.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118773", "to_ids": true, "type": "url", "uuid": "327047ca-9103-45bf-81e5-654d67fb8e98", "value": "http://3.139.85.102/17_eudhfj/regerem.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118794", "to_ids": true, "type": "url", "uuid": "006844a2-8298-43f1-836f-8d2fd4c7caf5", "value": "http://3.139.85.102/18_vdsyuh/revigore.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118816", "to_ids": true, "type": "url", "uuid": "04de9656-e99c-4e65-b935-a6cd7f34cfcd", "value": "http://3.139.85.102/20_fjegydk/destravares.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118837", "to_ids": true, "type": "url", "uuid": "fcb3df56-d9a9-41b7-9eec-1280216cff1b", "value": "http://3.141.199.105/13_ytdshe/reimpresso.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118858", "to_ids": true, "type": "url", "uuid": "5f93c4c9-57b4-4125-ae0d-51a9c8162be0", "value": "http://3.141.199.105/15_rjhsymc/unificador.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118879", "to_ids": true, "type": "url", "uuid": "f1f8ed52-df3f-4586-9586-a88ba77a7c1d", "value": "http://3.141.199.105/16_kdsgyue/raquete.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118901", "to_ids": true, "type": "url", "uuid": "7093799f-7f20-46b1-b8e9-f25bac51d504", "value": "http://3.144.37.134/01_sdneow/fruais.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118922", "to_ids": true, "type": "url", "uuid": "ffa254ca-5cd6-40ef-a8ef-d747e5495338", "value": "http://3.144.37.134/02_sjdhie/reestruturado.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118944", "to_ids": true, "type": "url", "uuid": "6ce57404-792c-4997-866a-9b8d14fac874", "value": "http://3.144.37.134/03_osneops/trapezio.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118965", "to_ids": true, "type": "url", "uuid": "b74dddcf-0833-40d3-ac18-29315d01e5a0", "value": "http://3.148.240.228/05_dnwodu/equivaler.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785118986", "to_ids": true, "type": "url", "uuid": "d67c3d07-5f47-454b-a2da-045178e0d9a7", "value": "http://3.148.240.228/06_sndiwds/galgassem.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785119007", "to_ids": true, "type": "url", "uuid": "a6862af5-7a81-491c-8d4a-ccce5a5ec7cd", "value": "http://3.150.134.118/05_papel6197/equivaler.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785119028", "to_ids": true, "type": "url", "uuid": "94d52eb2-6ab5-4929-9e60-ff709e570628", "value": "http://3.150.134.118/06_couro8254/galgassem.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "VBS final stage C2 host; validate before blocking", "deleted": false, "disable_correlation": false, "timestamp": "1785119049", "to_ids": true, "type": "url", "uuid": "f0a1d392-87c6-40a5-b32f-bd9489f85644", "value": "http://52.14.160.173/10_algodao9148/reunia.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119070", "uuid": "be25a703-2e24-4f91-9417-c8c768460554", "Attribute": [ { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "md5", "timestamp": "1785119070", "to_ids": true, "type": "md5", "uuid": "176b5e1e-bfb6-4bb3-accd-0e2252bbb1de", "value": "b806cf43175e2d18b95c5eda1f33caae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "sha1", "timestamp": "1785118256", "to_ids": true, "type": "sha1", "uuid": "1dcc3ad2-8ece-495e-ac08-637eade7d814", "value": "ffbf895324d1d4a089019eb5b43e3f82e39d2094", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "sha256", "timestamp": "1785118256", "to_ids": true, "type": "sha256", "uuid": "d2b50a8c-5f03-41c2-bb2c-298c5cc14e75", "value": "036c8f32012abdcb9a389ae9c284da89505e830bca74eb1aa9ea3794b067aab6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "text", "timestamp": "1785116437", "to_ids": false, "type": "text", "uuid": "f4f8873c-d0cd-4aa0-8c43-c7002d029e60", "value": "HTML file\r\nType Description: HTML\nMicrosoft: None\nClamAV: None\nVT Total Detection: 3/74\nFirst Submission: 2026-06-01T09:58:20+00:00\nLast Submission: 2026-06-01T10:01:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "ssdeep", "timestamp": "1785116437", "to_ids": true, "type": "ssdeep", "uuid": "36ee3602-c8f4-41fd-9609-bd86558277b5", "value": "24576:SpuVtB+gneslf2WaJdIo0WJ3zdPTLYPoOMg3ix5pU:Sc5NDEcL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116437", "to_ids": false, "type": "size-in-bytes", "uuid": "c85eeb32-f91d-44e9-87d3-ba43b14ba41d", "value": "1329178" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "vhash", "timestamp": "1785116437", "to_ids": true, "type": "vhash", "uuid": "fcb6649a-8f93-4975-bdea-4752b0080ad6", "value": "bb557f4e7f4d5552870ea9eb0b0bf7e8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T09:58:20+00:00", "last_seen": "2026-06-01T10:01:32+00:00", "object_relation": "filename", "timestamp": "1785116437", "to_ids": true, "type": "filename", "uuid": "f1b77cd8-5949-4f78-8d17-5f1774015866", "value": "COMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.html" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119092", "uuid": "a59401ff-8bfa-40ee-bee0-a858196d4628", "Attribute": [ { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "md5", "timestamp": "1785119092", "to_ids": true, "type": "md5", "uuid": "3e4fc322-c875-4b1d-b31a-25157deeccd5", "value": "3a42b95c4d4ef347ec664200e612b794", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "sha1", "timestamp": "1785118257", "to_ids": true, "type": "sha1", "uuid": "5273b860-8a30-4698-a689-c39dcd3763c2", "value": "0df586b6f52273d0e239ae80c43efd80f55916da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "sha256", "timestamp": "1785118258", "to_ids": true, "type": "sha256", "uuid": "a05754aa-7bcb-4a0f-9a6f-0cb065a8c664", "value": "050e84d134a32ed7c4885a9d57ce37f8ae5f910960b67e2156941961bd5781ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 26/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "text", "timestamp": "1785116459", "to_ids": false, "type": "text", "uuid": "3256da64-c0a6-404f-8e02-0f3057438809", "value": "HTML file\r\nType Description: HTML\nMicrosoft: None\nClamAV: None\nVT Total Detection: 8/74\nFirst Submission: 2026-05-14T14:02:47+00:00\nLast Submission: 2026-05-14T14:02:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "ssdeep", "timestamp": "1785116459", "to_ids": true, "type": "ssdeep", "uuid": "6d8d1f88-8ee1-4040-bf54-fd45b5a3ebf7", "value": "24576:MNVh2vxxlyvOgxYvz20MRW8GJDhl/Va/0+YGcyxHbM1/aiU0:NlLNSNw//EFYyu1z" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116459", "to_ids": false, "type": "size-in-bytes", "uuid": "db90450b-c424-4348-9621-cc65815d2845", "value": "1139352" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "vhash", "timestamp": "1785116459", "to_ids": true, "type": "vhash", "uuid": "c82a4f9c-b61c-42a5-87b8-b70206fb08c8", "value": "ffc03e93001f8453e725ddc967c8977e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T14:02:47+00:00", "last_seen": "2026-05-14T14:02:47+00:00", "object_relation": "filename", "timestamp": "1785116459", "to_ids": true, "type": "filename", "uuid": "d38ff289-e39d-4b93-92fd-b7118afc2df3", "value": "COMPROVATIVO-MAIO_cKpbGgeXQjlKQwk_14-05-2026_55.html" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119113", "uuid": "7356005b-a1d4-4d5c-894a-5a61ad02cd04", "Attribute": [ { "category": "Payload delivery", "comment": "Final stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "md5", "timestamp": "1785119113", "to_ids": true, "type": "md5", "uuid": "150ea31f-dc25-4667-9f6b-9e16e9d1a520", "value": "1b80b72ee086ef40dcba826e12cad7aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Final stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "sha1", "timestamp": "1785118259", "to_ids": true, "type": "sha1", "uuid": "97337404-afce-4c43-8ca6-5409f97bf529", "value": "aaa9f19c69ca759036f4f701d9c0efab81a6473f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Final stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "sha256", "timestamp": "1785118259", "to_ids": true, "type": "sha256", "uuid": "f115dba7-ec21-476a-a751-36f2fc4bb11e", "value": "1541c23f34eb05dfcbede3830741427681d719cee1dfd397a2c04110e0fa81b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "text", "timestamp": "1785116480", "to_ids": false, "type": "text", "uuid": "e1a15d56-d360-4e95-9f15-787603094364", "value": "Final stage VBS\r\nType Description: VBA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 17/74\nFirst Submission: 2026-06-19T08:42:49+00:00\nLast Submission: 2026-06-19T08:42:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "ssdeep", "timestamp": "1785116480", "to_ids": true, "type": "ssdeep", "uuid": "3687ba69-dddd-46e5-9c61-af8379adf56c", "value": "49152:Dyjf6d2JV0e39A1u1lQ9QP+i9eZo46MQbtjxFhy22tfDza6GT7aHUULKsz9pHsI/:N" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116480", "to_ids": false, "type": "size-in-bytes", "uuid": "7f0f84a0-1c05-4e08-8f3f-3e21dfc62497", "value": "81591187" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T08:42:49+00:00", "last_seen": "2026-06-19T08:42:49+00:00", "object_relation": "filename", "timestamp": "1785116480", "to_ids": true, "type": "filename", "uuid": "c2a9ac40-f183-4a1e-a96d-82baed874ad2", "value": "44.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119134", "uuid": "26d2befe-0b60-4ff3-87ee-7cb435e4b23e", "Attribute": [ { "category": "Payload delivery", "comment": "Second stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "md5", "timestamp": "1785119134", "to_ids": true, "type": "md5", "uuid": "b8f05a74-8766-48be-9ec2-720adc7bcd49", "value": "77fd7c6acb63e12703eec5b343dc8d5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Second stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "sha1", "timestamp": "1785118260", "to_ids": true, "type": "sha1", "uuid": "03efcf94-13f9-476a-8d85-4b4f9f9c5012", "value": "18a1f86499308294ed59ffad70db645f32c378ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Second stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "sha256", "timestamp": "1785118260", "to_ids": true, "type": "sha256", "uuid": "46764b2b-d2ef-44ed-b6d6-8bba4b315d14", "value": "1bd347ce5deee3d783a038e2d2d224bc30cc074e0471a3897c5409ce99816dc9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "text", "timestamp": "1785116503", "to_ids": false, "type": "text", "uuid": "9dccb676-b296-42ac-bdd5-0781c57c0980", "value": "Second stage VBS\r\nType Description: VBA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2026-05-18T15:57:01+00:00\nLast Submission: 2026-05-18T15:57:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "ssdeep", "timestamp": "1785116503", "to_ids": true, "type": "ssdeep", "uuid": "65f1e212-c201-4028-82bc-e88ab7b13782", "value": "12288:uoMDkE0ZaaVs83VVCdrwKKUk2cVAsSEMFaaeEuJHtB0/ZtG0p5k3qS:UDkE0ZTV9FoMecR7MOqh/6x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116503", "to_ids": false, "type": "size-in-bytes", "uuid": "af6b4966-6d4d-4296-bade-dae34149cc71", "value": "4745201" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T15:57:01+00:00", "last_seen": "2026-05-18T15:57:01+00:00", "object_relation": "filename", "timestamp": "1785116503", "to_ids": true, "type": "filename", "uuid": "378aef49-34b1-4ddf-a4a6-75008cbdc1a6", "value": "Comprovativo_Maio_18-05-2026-pXiaBxQ.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119155", "uuid": "d7be1f87-253f-42ab-9dee-cf5fd1a6c1aa", "Attribute": [ { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "md5", "timestamp": "1785119155", "to_ids": true, "type": "md5", "uuid": "15986c25-1529-4371-88df-827b73284a7e", "value": "3032fdd75ee8c618e6f2231956ba2897", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "sha1", "timestamp": "1785118262", "to_ids": true, "type": "sha1", "uuid": "1cbce338-4586-4ece-b793-9e3aaebc3d88", "value": "6522913701ea678a6d1c6b5e6d239f35e3cd861e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "sha256", "timestamp": "1785118262", "to_ids": true, "type": "sha256", "uuid": "2b74330c-5d34-4c1c-9334-ff550789304a", "value": "643c0093baec45952a46b0210f7a6f8fb26883b396b66f1cb609c5b55e6dae1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 26/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "text", "timestamp": "1785116524", "to_ids": false, "type": "text", "uuid": "77d364fc-a21f-4489-93d9-17b1e1f1d214", "value": "HTML file\r\nType Description: HTML\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-05-12T09:09:00+00:00\nLast Submission: 2026-05-12T09:11:27+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "ssdeep", "timestamp": "1785116524", "to_ids": true, "type": "ssdeep", "uuid": "bbd7b1c2-8a11-48af-b27d-a7a297d25316", "value": "24576:+39dviRt5l69axxjoeE9pK81TuO/pRbb+fMln+BtUtyUYUCaCkJp:eaRtT5cc8lX+BqhCvkp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116524", "to_ids": false, "type": "size-in-bytes", "uuid": "0439c241-fad1-4f8e-988c-0f82d1cb5002", "value": "1132384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "vhash", "timestamp": "1785116524", "to_ids": true, "type": "vhash", "uuid": "c2e52321-f513-452d-86ff-bcd6ae865755", "value": "4e3df8fafaee39c29f9cadbe1a25234c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T09:09:00+00:00", "last_seen": "2026-05-12T09:11:27+00:00", "object_relation": "filename", "timestamp": "1785116524", "to_ids": true, "type": "filename", "uuid": "7bd89ebc-40e5-4274-a7cb-3d921fe2a80d", "value": "COMPROVATIVO-MAIO_AEVyweqQaoSlJIZdfftOjO_12-05-2026_32.html" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119176", "uuid": "cdd46238-b585-4f5e-b65b-0343fcecf3d0", "Attribute": [ { "category": "Payload delivery", "comment": "Second stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "md5", "timestamp": "1785119176", "to_ids": true, "type": "md5", "uuid": "ead698f0-6237-41ff-9da3-bbd163f31679", "value": "df561a334071b4cf55dd1912ce3ca3d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Second stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "sha1", "timestamp": "1785118263", "to_ids": true, "type": "sha1", "uuid": "ec2c3272-ea91-4fd9-932f-ee53e73d06d1", "value": "a6abf36494cc880549d377f3a4706f47be301a45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Second stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "sha256", "timestamp": "1785118264", "to_ids": true, "type": "sha256", "uuid": "5832f2e8-aa40-45e3-bbb6-e704765ea0f4", "value": "7ad89fb0a4a5449a381b8f540238193019673adc7cfb1c008dcd14a745891551", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "text", "timestamp": "1785116546", "to_ids": false, "type": "text", "uuid": "705f2c06-f646-4e64-8a8c-aeca6000469c", "value": "Second stage VBS\r\nType Description: VBA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 20/74\nFirst Submission: 2026-06-17T09:27:05+00:00\nLast Submission: 2026-06-17T09:27:05+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "ssdeep", "timestamp": "1785116546", "to_ids": true, "type": "ssdeep", "uuid": "93646d90-11ed-4fea-8ab8-5849a83112db", "value": "12288:Q1Wk0A57ZzDTdioYgT0ddPgyQVrl3993glW2CEzakMA404ZEkn9Tou0+qZxZuAzU:Cj7JTXYgsdIR3/QdL1trPZ+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116546", "to_ids": false, "type": "size-in-bytes", "uuid": "023d5f46-ef75-4f48-827d-c0e7cb692def", "value": "7684629" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "vhash", "timestamp": "1785116546", "to_ids": true, "type": "vhash", "uuid": "efac5091-fea3-4aad-b521-b469cf9b7373", "value": "a36633649e9d49e47d44453ea38f05f4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T09:27:05+00:00", "last_seen": "2026-06-17T09:27:05+00:00", "object_relation": "filename", "timestamp": "1785116546", "to_ids": true, "type": "filename", "uuid": "6f8a1f56-7d72-43ef-acc3-cceb2e03b627", "value": "Comprovativo_Junho_15-06-2026-WjGAxGL.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119198", "uuid": "face33d0-9acb-4fbf-910c-e464430f60a2", "Attribute": [ { "category": "Payload delivery", "comment": "Phishing email", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "object_relation": "md5", "timestamp": "1785119198", "to_ids": true, "type": "md5", "uuid": "5967d22a-435b-4268-be8a-596636a92cb5", "value": "febf2a71caa6f7663545bf7e98593334", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Phishing email", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "object_relation": "sha1", "timestamp": "1785118264", "to_ids": true, "type": "sha1", "uuid": "23098957-3a11-4444-af5d-1e1300cc80d1", "value": "294cad776a9868aa3c01281ecc53d0eb8768f128", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Phishing email", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "object_relation": "sha256", "timestamp": "1785118264", "to_ids": true, "type": "sha256", "uuid": "89b855fb-dc4d-4e3b-be74-f23144a9c75c", "value": "87efeada5fe39a94cefc6151fd84af223d0e0e2b070daec606274481ed87b87b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "object_relation": "text", "timestamp": "1785116567", "to_ids": false, "type": "text", "uuid": "da2f724a-8c31-47e3-9daf-3ad6e0ad4561", "value": "Phishing email\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-06-03T08:37:49+00:00\nLast Submission: 2026-06-03T08:37:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "object_relation": "ssdeep", "timestamp": "1785116567", "to_ids": true, "type": "ssdeep", "uuid": "cbf890f2-fd1e-4088-a80a-02dfc95b3e44", "value": "24576:+LfPGRlalfnWPRBKYLNsv7UP5EmRi1WVHyuxxQM33Wsbxa/:6HGRqfcBw7UPrTTxnGMw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T08:37:49+00:00", "last_seen": "2026-06-03T08:37:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116567", "to_ids": false, "type": "size-in-bytes", "uuid": "b48b0dbc-2497-4316-bf17-8ddbe1095ddd", "value": "1083047" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119219", "uuid": "92f2ed30-8c45-4e82-95f5-c2a5f6b092ab", "Attribute": [ { "category": "Payload delivery", "comment": "Phishing email", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "md5", "timestamp": "1785119219", "to_ids": true, "type": "md5", "uuid": "71d9e730-1ec4-45b2-8f6a-6bcfce475e36", "value": "5f63b36b4594815b33ca77993469ded8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Phishing email", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "sha1", "timestamp": "1785118266", "to_ids": true, "type": "sha1", "uuid": "f7a4eb2b-5d76-46e2-a763-3655158d7e00", "value": "e5d5d2b5becbfe9fbc93b47d9c5322d022c6bad2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Phishing email", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "sha256", "timestamp": "1785118266", "to_ids": true, "type": "sha256", "uuid": "460ae5aa-8d0a-4906-986d-0c5c2ca85315", "value": "ab46f7c4d3f717bb1e61d2f236917976d2a85be6958ae099fee79ea6e9031e37", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "text", "timestamp": "1785116589", "to_ids": false, "type": "text", "uuid": "004d1d06-cd2a-401e-b5d2-bc4a13390bf6", "value": "Phishing email\r\nType Description: Outlook\nMicrosoft: None\nClamAV: None\nVT Total Detection: 22/74\nFirst Submission: 2026-05-08T13:24:39+00:00\nLast Submission: 2026-05-08T13:24:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "ssdeep", "timestamp": "1785116589", "to_ids": true, "type": "ssdeep", "uuid": "fc3bb78e-c24e-4507-9fe7-8519eefff6f3", "value": "12288:9rF5A34DORD24bgcLXd2lpOj7CBZ6AQqAnPxx21W:9rq4DORD2LsnP4tQqAPxs1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116589", "to_ids": false, "type": "size-in-bytes", "uuid": "0dad9ba5-9810-4239-b22f-0f1279409b96", "value": "683008" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-08T13:24:39+00:00", "last_seen": "2026-05-08T13:24:39+00:00", "object_relation": "vhash", "timestamp": "1785116589", "to_ids": true, "type": "vhash", "uuid": "cea301a7-5355-49d9-82d5-6d1d1df3e1fc", "value": "fe43cc098163d8fb4f1b2b088de0949b" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119240", "uuid": "5d7e4e1e-bdbb-4b42-8a7d-700c544e2153", "Attribute": [ { "category": "Payload delivery", "comment": "Zip attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "md5", "timestamp": "1785119240", "to_ids": true, "type": "md5", "uuid": "534a6956-f814-45d1-914c-6a2c6c8739e0", "value": "3d23a41333f3e53fccf7caca8a75cb43", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Zip attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "sha1", "timestamp": "1785118267", "to_ids": true, "type": "sha1", "uuid": "8e0eaf52-0dae-4994-ae82-2b3eb30dcbec", "value": "b97f9d581dd0bc4591d4c9c3013df82a39d1d314", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Zip attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "sha256", "timestamp": "1785118267", "to_ids": true, "type": "sha256", "uuid": "52b0eea5-cf69-4d2f-bf48-9d81addadf82", "value": "b1c101bd1ba134ffbea61f9fac2b7c8fbd13ca113a37944abdc131ef86da92ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "text", "timestamp": "1785116610", "to_ids": false, "type": "text", "uuid": "4747884e-9375-4e18-8a63-a76585a7e604", "value": "Zip attachment\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 3/74\nFirst Submission: 2026-06-01T10:00:44+00:00\nLast Submission: 2026-06-01T10:00:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "ssdeep", "timestamp": "1785116610", "to_ids": true, "type": "ssdeep", "uuid": "66951b87-ae06-4d82-992f-5d33efa93539", "value": "12288:oX/xByr6Lf4l4kNqOJBWFeS7dlFHyivVAY0s1SWYxyp5AYlVBWEI45S8D8L2YOAp:aLn09BWUQjSiOASksijWY/6tO1O" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116610", "to_ids": false, "type": "size-in-bytes", "uuid": "882bf61c-6a0b-4ab8-b1b4-b4c4c9f3fb16", "value": "783348" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "vhash", "timestamp": "1785116610", "to_ids": true, "type": "vhash", "uuid": "491d4e38-d151-4ecf-be76-14995b2a249c", "value": "6a023c931d6fad8ff8dc44f488a3aa99" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T10:00:44+00:00", "last_seen": "2026-06-01T10:00:57+00:00", "object_relation": "filename", "timestamp": "1785116610", "to_ids": true, "type": "filename", "uuid": "d672fbb4-178e-4c55-a08d-d6f626aa62ed", "value": "COMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119261", "uuid": "6e321968-41ff-480c-bb75-d189cd7d77a8", "Attribute": [ { "category": "Payload delivery", "comment": "Zip attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "md5", "timestamp": "1785119261", "to_ids": true, "type": "md5", "uuid": "c7897bc5-976d-4410-8d20-e065e25c7152", "value": "c98db590c0cf0210c9a127387bb679f6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Zip attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "sha1", "timestamp": "1785118268", "to_ids": true, "type": "sha1", "uuid": "6e35ed6e-e73b-4d85-8368-ed335d1eeb73", "value": "49238d8b3d4539b5c9c8cde550808bb0c684fd88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Zip attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "sha256", "timestamp": "1785118269", "to_ids": true, "type": "sha256", "uuid": "274732b9-07d3-40f6-810c-5a77fa916083", "value": "c6618bb692fb3f5d7959f8db1fedaaac5e8a36fb901397a008aa2b88874448fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "text", "timestamp": "1785116632", "to_ids": false, "type": "text", "uuid": "60a91889-910a-4606-991b-dd705594f71d", "value": "Zip attachment\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 3/74\nFirst Submission: 2026-05-29T13:52:59+00:00\nLast Submission: 2026-05-29T13:52:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "ssdeep", "timestamp": "1785116632", "to_ids": true, "type": "ssdeep", "uuid": "c7ea2651-524f-4543-b50b-ecfe84845525", "value": "12288:273La4e/Me/pF+Tjn4IU6SDG/p9AT5D4dfuU5fqGfPa3kC4bvaJw/1VlNdl4obr+:Wm4Ve/pFG4/BDG/pmdD49tPa0C47aw1m" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116632", "to_ids": false, "type": "size-in-bytes", "uuid": "969ca67c-72f4-4926-b209-6a9f2090088c", "value": "782690" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "vhash", "timestamp": "1785116632", "to_ids": true, "type": "vhash", "uuid": "76cf8c80-5cf8-48ce-af76-65080b094bb5", "value": "6a023c931d6fad8ff8dc44f488a3aa99" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T13:52:59+00:00", "last_seen": "2026-05-29T13:52:59+00:00", "object_relation": "filename", "timestamp": "1785116632", "to_ids": true, "type": "filename", "uuid": "81229115-c54a-44a7-97dd-12c6c541c166", "value": "COMPROVATIVO-MAIO_zBxoIraynYZlJFlnEkqfK_29-05-2026_366.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119282", "uuid": "533aca08-9aee-4c8e-9456-46a2f4dd855a", "Attribute": [ { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "md5", "timestamp": "1785119282", "to_ids": true, "type": "md5", "uuid": "350d893d-664b-462e-95ee-8e964a3bf720", "value": "676b20c336c6d0c51acff86b5a079bac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "sha1", "timestamp": "1785118270", "to_ids": true, "type": "sha1", "uuid": "909fe85e-f3ae-4b77-b3c4-d9db3226fb21", "value": "525d86c9a19360b5e8274352a3b135f323bb279e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "HTML file", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "sha256", "timestamp": "1785118270", "to_ids": true, "type": "sha256", "uuid": "39f9b5da-3e52-46ad-953d-0016534ae901", "value": "d25d32478ae67403484a309591b6409224d26ca3d094c5ccd8428ebef7efcfd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "text", "timestamp": "1785116654", "to_ids": false, "type": "text", "uuid": "c7cab9e6-270d-4818-b5db-3d443f0a3253", "value": "HTML file\r\nType Description: HTML\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-06-01T12:23:49+00:00\nLast Submission: 2026-06-01T12:23:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "ssdeep", "timestamp": "1785116654", "to_ids": true, "type": "ssdeep", "uuid": "9a73ec16-2e6e-42ab-aefa-44082c3774f8", "value": "24576:7kI07sP8Vt7uHhbPblcg42g71TBOBNXMzPpwL+kyAJ4MlYSJM0jYRI:fasP84PbdgE8+n3t3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116654", "to_ids": false, "type": "size-in-bytes", "uuid": "66ff9596-5c27-497f-a823-8ae8da40329f", "value": "1330690" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "vhash", "timestamp": "1785116654", "to_ids": true, "type": "vhash", "uuid": "1aa8fdb4-5a1b-4219-a126-432b086299b6", "value": "9728e555bc5b70b9df46487be6d9ce6c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-01T12:23:49+00:00", "last_seen": "2026-06-01T12:23:49+00:00", "object_relation": "filename", "timestamp": "1785116654", "to_ids": true, "type": "filename", "uuid": "24f73f9b-bb2e-4fab-9975-93c4a176d1b8", "value": "COMPROVATIVO-JUNHO_ynSRmtoVWCRBgspqzkAn_01-06-2026_106-1.html" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119303", "uuid": "9b46d922-b5f1-48ec-9aeb-7ab2f3bad55b", "Attribute": [ { "category": "Payload delivery", "comment": "Final stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "md5", "timestamp": "1785119303", "to_ids": true, "type": "md5", "uuid": "953aad5a-adf3-4328-b133-972ad4773ede", "value": "75ce45ba9d5a3233ae21a274605cbc13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Final stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "sha1", "timestamp": "1785118271", "to_ids": true, "type": "sha1", "uuid": "d7d693b9-ab50-4aea-8cfc-12278698b456", "value": "d75fbee84096d7b293e32b8cf27e0b18551bddb1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Final stage VBS", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "sha256", "timestamp": "1785118271", "to_ids": true, "type": "sha256", "uuid": "46585ddb-ae59-46ac-8a11-fc96e6e6d6bc", "value": "fe769fd85a7440751e1508614c8d9ef0de00bece803329bf3318ff863a146216", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "text", "timestamp": "1785116675", "to_ids": false, "type": "text", "uuid": "4eea8d35-441d-462e-bba1-e171999e3463", "value": "Final stage VBS\r\nType Description: VBA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2026-05-12T14:23:51+00:00\nLast Submission: 2026-05-12T14:23:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "ssdeep", "timestamp": "1785116675", "to_ids": true, "type": "ssdeep", "uuid": "af3a6397-6e77-4cfa-8e95-25be2e87db1d", "value": "49152:t5TZc/UxA+yunIdqBWBfdR22fr4kSdq6dvow8C9S4sYtk0OVBjYbzH6VDpSeuoLC:B" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116675", "to_ids": false, "type": "size-in-bytes", "uuid": "ecfbd364-034a-4674-99d4-871fde0d1a2e", "value": "72448323" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "vhash", "timestamp": "1785116675", "to_ids": true, "type": "vhash", "uuid": "e29eeebf-4a79-45c9-8d95-a386d30508d9", "value": "a36633649e9d49e47d44453ea38f05f4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T14:23:51+00:00", "last_seen": "2026-05-12T14:23:51+00:00", "object_relation": "filename", "timestamp": "1785116675", "to_ids": true, "type": "filename", "uuid": "39761f2b-37ee-456f-8719-c219490d4f74", "value": "14.vbs" } ] } ] } }