{ "Event": { "analysis": "1", "date": "2026-05-26", "extends_uuid": "", "info": "[Threat Intel] Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet", "protected": false, "publish_timestamp": "1780368421", "published": true, "threat_level_id": "3", "timestamp": "1780368421", "uuid": "ead1cc2e-5a16-47f9-b9e0-6e8cd5ff1dfc", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#717bc3", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#73cdf4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Portable Executable Injection - T1055.002\"", "relationship_type": "" }, { "colour": "#9e0269", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#d82db7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#7d37d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#e22a4a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credential API Hooking - T1056.004\"", "relationship_type": "" }, { "colour": "#e6caf2", "local": false, "name": "misp-galaxy:target-information=\"Switzerland\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SectopRAT\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1a0063", "local": false, "name": "rectifyq:topic=\"web3\"", "relationship_type": "" }, { "colour": "#1a0065", "local": false, "name": "rectifyq:topic=\"crypto-related\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1779937216", "to_ids": false, "type": "link", "uuid": "fcb69c72-eedd-4952-916d-2df86bbfee9c", "value": "https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1779937216", "to_ids": false, "type": "text", "uuid": "31082ca9-ee3d-43fd-adbe-462ef29a5102", "value": "Threat actors exploited the EtherHiding technique to store ClearFake payload routing instructions within smart contracts on the BNB Smart Chain testnet, creating an immutable command-and-control infrastructure that cannot be taken down. The attack began with injected JavaScript on a compromised Swiss website that queried blockchain contracts to deliver malicious payloads. Victims passing anti-analysis checks were fingerprinted by operating system and routed to platform-specific ClickFix social engineering overlays. The campaign simultaneously deployed SectopRAT, a .NET-based remote access trojan capable of browser session hijacking, and ACRStealer, a C++ infostealer targeting credentials and cryptocurrency wallets. An on-chain execution tracker confirmed each compromise in real time. Four smart contracts shared a single deployer wallet, with the oldest deployed nearly a year before analysis, indicating a long-running, actively maintained operation." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1779937216", "to_ids": false, "type": "text", "uuid": "8f044327-5c3d-4985-9104-21d578214d11", "value": "Name: Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet\nAuthor: AlienVault\nAdversary: \nTags: [\"infostealer\", \"blockchain c&c\", \"clickfix\", \"etherhiding\", \"sectoprat\", \"clearfake\", \"bnb smart chain\", \"acrstealer\"]\nTgtd countries: [\"Switzerland\"]\nMlwr families: [\"SectopRAT\", \"ACRStealer\"]\nAttack_ids: [\"T1539\", \"T1036.005\", \"T1204.002\", \"T1497.001\", \"T1140\", \"T1185\", \"T1555.003\", \"T1055.002\", \"T1102\", \"T1059.001\", \"T1055.012\", \"T1027\", \"T1012\", \"T1518.001\", \"T1059.006\", \"T1189\", \"T1071.001\", \"T1105\", \"T1056.004\"]\nIndustries: []" }, { "category": "Network activity", "comment": "Queried by rundll32.exe", "deleted": false, "disable_correlation": false, "timestamp": "1780300377", "to_ids": true, "type": "hostname", "uuid": "2cda9c1f-5347-4f3b-81db-2c84918c384a", "value": "afraid.veloitall.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Primary WebDAV host observed in endpoint telemetry; hosts put34b.camp", "deleted": false, "disable_correlation": false, "timestamp": "1780300398", "to_ids": true, "type": "hostname", "uuid": "bd63c0a8-2a12-4000-89c6-9294d2d86210", "value": "root-cul.xamir3on.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Queried by rundll32.exe", "deleted": false, "disable_correlation": false, "timestamp": "1780300419", "to_ids": true, "type": "hostname", "uuid": "4ca1fc44-e78c-440e-96af-54bc3299c27f", "value": "ohn.stainedunstitch.work", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Alternate WebDAV host hardcoded in Stage 3 JS; domain rotation infrastructure", "deleted": false, "disable_correlation": false, "timestamp": "1780300441", "to_ids": true, "type": "hostname", "uuid": "0da992ed-9aef-475a-ae1c-4543dc34fb6e", "value": "getcfgs.qen9varol.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Queried by both rundll32.exe and dllhost.exe", "deleted": false, "disable_correlation": false, "timestamp": "1780300462", "to_ids": true, "type": "hostname", "uuid": "a4befd95-4292-4549-9bd2-046f7634692d", "value": "ootid.srv-auth-dlt-msh.in.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780300483", "to_ids": true, "type": "domain", "uuid": "ec97b0f4-261f-4446-9d4b-037aacc0312b", "value": "put34b.camp", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "queried by rundll32.exe and powershell.exe", "deleted": false, "disable_correlation": false, "timestamp": "1780300504", "to_ids": true, "type": "hostname", "uuid": "60fdd476-759e-4e96-84bb-05f749c47255", "value": "ren.trytoken.life", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Legitimate recreational Swiss WordPress site, ClearFake JS injected at line 146 of ", "deleted": false, "disable_correlation": false, "timestamp": "1780300526", "to_ids": true, "type": "hostname", "uuid": "23cc48dc-aab9-45e4-8e62-f802851fe674", "value": "www.badischwaendi.ch", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "BSC testnet RPC endpoint", "deleted": false, "disable_correlation": false, "timestamp": "1780300547", "to_ids": true, "type": "hostname", "uuid": "2d50412b-269a-4ecb-9487-331667a12504", "value": "bsc-testnet-rpc.publicnode.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ClearFake geo-targeting + victim UUID capture", "deleted": false, "disable_correlation": false, "timestamp": "1780300568", "to_ids": true, "type": "hostname", "uuid": "fd5e20ee-3faf-402a-883f-f8f4139abc74", "value": "ip-info.ff.avast.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Queried by dllhost.exe", "deleted": false, "disable_correlation": false, "timestamp": "1780300589", "to_ids": true, "type": "hostname", "uuid": "dee6f9de-b9df-4b2a-941c-b6bee76357ee", "value": "download2324.mediafire.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Yandex Metrika analytics injected by macOS Stage 3 payload", "deleted": false, "disable_correlation": false, "timestamp": "1780300611", "to_ids": true, "type": "hostname", "uuid": "e822948b-f70e-4434-bf81-5b0b8583c8b2", "value": "mc.yandex.ru", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300632", "uuid": "4c5c6685-8445-4f7a-9dcf-6b17a51255a2", "Attribute": [ { "category": "Payload delivery", "comment": "A malicious DLL masquerading as a legitimate VLC media player component, sideloaded by the legitimate vlc.exe", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300632", "to_ids": true, "type": "md5", "uuid": "d5e92a4a-4118-403e-993e-4458e3683a62", "value": "4d63c25457d3d5bd37bcf7c3d10154e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "A malicious DLL masquerading as a legitimate VLC media player component, sideloaded by the legitimate vlc.exe", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298401", "to_ids": true, "type": "sha1", "uuid": "11c1cd3d-fb08-4f0b-bc2a-1f54ac57938d", "value": "b654603260e52faefd9b5b1aad1ca4bd233f9167", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "A malicious DLL masquerading as a legitimate VLC media player component, sideloaded by the legitimate vlc.exe", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298401", "to_ids": true, "type": "sha256", "uuid": "5e618cc6-d21b-405f-8cc6-abae0155e3c8", "value": "46add4a5fb2da6fe12759a06fe1c6bc43e987da3ea7c28bff0a7f2a349088f0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780296059", "to_ids": true, "type": "ssdeep", "uuid": "3bac13bd-41c0-4c0b-963b-8a2a519a92e7", "value": "196608:OVq5kkjg2azNCUPIN8/DzajDDWAdVSKtB/y:Lkk8D4UPSUDza/KAdwI9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780296059", "to_ids": false, "type": "size-in-bytes", "uuid": "d3a2a6b0-f4df-47b3-ba01-d1936666422b", "value": "7205888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780296059", "to_ids": true, "type": "vhash", "uuid": "045bb364-1997-4d95-8668-c66f578dd64f", "value": "1760965d55655c05555d0018z191dfz13z15z14z2fd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780296059", "to_ids": true, "type": "filename", "uuid": "f1ff6ee8-f47a-4ef4-967f-f7858f4269d7", "value": "libvlccore.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780296059", "to_ids": false, "type": "text", "uuid": "5239aa79-0f37-4f45-9c17-d86c450d8e14", "value": "A malicious DLL masquerading as a legitimate VLC media player component, sideloaded by the legitimate vlc.exe\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Posilod!rfn\nVT Total Detection:35/71\nFirst Submission:2026-05-06T07:48:48.000000+00:00\nLast Submission:2026-05-06T07:48:48.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300653", "uuid": "15955ba3-974c-4238-831f-76d34ed89ddb", "Attribute": [ { "category": "Payload delivery", "comment": "Malicious DLL delivered over WebDAV (using the non-standard .camp extension to evade DLL-monitoring rules).", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300653", "to_ids": true, "type": "md5", "uuid": "eb698116-32e9-4139-859f-47343074596b", "value": "7405da969d14833a77b4049b3b6a39b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Malicious DLL delivered over WebDAV (using the non-standard .camp extension to evade DLL-monitoring rules).", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298402", "to_ids": true, "type": "sha1", "uuid": "c3ee841e-f7ac-4f33-a494-23db6b4219d3", "value": "4f72551703b84ae70b0837a97523c66b21c538e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Malicious DLL delivered over WebDAV (using the non-standard .camp extension to evade DLL-monitoring rules).", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298403", "to_ids": true, "type": "sha256", "uuid": "1bda6b11-31a5-4271-b627-44649ae396dd", "value": "9c235a84d15087719e59c09f41d43e3574de4544d490aab619184a7d65b02910", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780296080", "to_ids": true, "type": "ssdeep", "uuid": "8a7f85e6-4101-457e-b9e3-d575a9fd37b5", "value": "49152:rnmhXp8PbM02Y6846bMye42/myhC9rLDPP7hl85rqCpbj8QcTtHLb+F/rOB+:rnfYFYE43J85p91F/rOB+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780296080", "to_ids": false, "type": "size-in-bytes", "uuid": "43c4956b-e396-4b90-ae31-85c0a2310060", "value": "4676096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780296080", "to_ids": true, "type": "vhash", "uuid": "7f2cb485-9954-4fd0-98f5-d98ab4512eab", "value": "146076655d155d0515501016z36nz101cz2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780296080", "to_ids": true, "type": "filename", "uuid": "c0ef6f2f-5806-4377-b2ae-9142144dd038", "value": "put34b.camp" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780296080", "to_ids": false, "type": "text", "uuid": "96abf2de-7dfa-4d88-94ab-a439219c0daa", "value": "Malicious DLL delivered over WebDAV (using the non-standard .camp extension to evade DLL-monitoring rules).\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/ACRStealer.AHC!MTB\nVT Total Detection:44/71\nFirst Submission:2026-05-06T12:12:21.000000+00:00\nLast Submission:2026-05-06T12:12:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300674", "uuid": "0743115d-9707-4660-9267-2bdc1de6e1ea", "Attribute": [ { "category": "Payload delivery", "comment": "A Python script deployed as part of the BYOI (Bring Your Own Interpreter) RAT staging in FileZilla\\Data\\DC80D99D\\. It is executed by pythonw.exe and serves as a shellcode loader.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300674", "to_ids": true, "type": "md5", "uuid": "696e32cc-adb8-46b5-8f5d-5893608be687", "value": "6691ffa5af2d4d3b3dea04e69185a79d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "A Python script deployed as part of the BYOI (Bring Your Own Interpreter) RAT staging in FileZilla\\Data\\DC80D99D\\. It is executed by pythonw.exe and serves as a shellcode loader.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298404", "to_ids": true, "type": "sha1", "uuid": "a035f7ac-747a-4f9d-b7c2-8d07188023a4", "value": "0eb9241b1530549c258537d647d2723879508778", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "A Python script deployed as part of the BYOI (Bring Your Own Interpreter) RAT staging in FileZilla\\Data\\DC80D99D\\. It is executed by pythonw.exe and serves as a shellcode loader.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298404", "to_ids": true, "type": "sha256", "uuid": "35da22ba-cb1a-4594-a9d3-ad5d0a618024", "value": "a5691a4fc69faa4f0fe08f12347783e1dde3c617552be7efd1c5ed89a793e885", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780296102", "to_ids": true, "type": "ssdeep", "uuid": "af3d4b8a-4aa7-4692-bedd-14a8d7ff5321", "value": "49152:N3ChvoqBNOIRg7XnnesQwWy0y0y/a0IkdqzMpwiriyE6LPeMiC:x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780296102", "to_ids": false, "type": "size-in-bytes", "uuid": "54e6c7ee-e4fa-45a3-bce7-b819f1d781ba", "value": "4470545" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780296102", "to_ids": true, "type": "filename", "uuid": "eb924452-ae64-4cee-9d1c-a56ea9318eae", "value": "helper (1).py" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780296102", "to_ids": false, "type": "text", "uuid": "cf221ced-e530-4ed1-96a7-ec2c1f363fac", "value": "A Python script deployed as part of the BYOI (Bring Your Own Interpreter) RAT staging in FileZilla\\Data\\DC80D99D\\. It is executed by pythonw.exe and serves as a shellcode loader.\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:27/62\nFirst Submission:2026-05-06T14:19:25.000000+00:00\nLast Submission:2026-05-11T17:08:19.000000+00:00" } ] } ] } }