{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] Upgrades MaaS Ecosystem with Modular Tools", "protected": false, "publish_timestamp": "1785577605", "published": true, "threat_level_id": "3", "timestamp": "1785577605", "uuid": "edde88f0-9f7d-44d3-bcb9-deb290ff465b", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#bf83fd", "local": false, "name": "misp-galaxy:producer=\"Recorded Future\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#8b05c0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Audio Capture - T1123\"", "relationship_type": "" }, { "colour": "#3eb869", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"", "relationship_type": "" }, { "colour": "#9dc839", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#682cad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#08221e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#6e0b83", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Regsvr32 - T1218.010\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"GC01\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"GC02\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"VENOM SPIDER\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Copy and Paste - T1204.004\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Cybercrime\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#10003f", "local": false, "name": "rectifyq:sub-category=\"tool-profile\"", "relationship_type": "" }, { "colour": "#3500ca", "local": false, "name": "rectifyq:detection-rules=\"yara-from-src\"", "relationship_type": "" }, { "colour": "#3500cd", "local": false, "name": "rectifyq:detection-rules=\"sigma-from-src\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862013", "to_ids": false, "type": "link", "uuid": "ccf6bb61-2cfc-4532-9d2f-de5d22fb75f7", "value": "https://www.recordedfuture.com/research/tag-195-evolves-maas-ecosystem" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862013", "to_ids": false, "type": "link", "uuid": "755aa673-0511-4318-bd6f-07b79c14e153", "value": "https://www.recordedfuture.com/research/media_108cee2fcb0c1792cbb340558328d069bb0036624.gif?width=1200&format=pjpg&optimize=medium" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862013", "to_ids": false, "type": "text", "uuid": "06fb7234-4fad-4475-8889-5c5fcb872b31", "value": "Insikt Group identified four new malware families from TAG-195 (Golden Chickens, Venom Spider), a financially motivated malware-as-a-service developer. The families include TinyEgg, a lightweight initial-access backdoor; ChonkyChicken, which expands capabilities with browser credential theft and session automation; a modularized ChonkyChicken variant using controller-and-plugin architecture; and ChromEggscalator, a modified Chrome encryption-bypass tool. TAG-127 has been observed deploying TinyEgg via ClickFix campaigns using fake security verification pages. The modular architecture reduces static detection exposure and enables selective capability provisioning to operators. All families share consistent architectural traits including WebSocket command-and-control, Run key persistence, string obfuscation, and execution via legitimate Windows binaries. This represents a deliberate architectural transition toward operator-driven tooling within the TAG-195 MaaS ecosystem." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862013", "to_ids": false, "type": "text", "uuid": "0763d4e4-d6f8-4a74-971c-06cd822edf8a", "value": "Name: Upgrades MaaS Ecosystem with Modular Tools\nAuthor: AlienVault\nAdversary: TAG-195\nTags: [\"revc2\", \"tinyegg\", \"terralogger\", \"maas\", \"websocket c2\", \"clickfix\", \"terrastealerv2\", \"tag-127\", \"browser credential theft\", \"chonkychicken\", \"chromeggscalator\", \"modular architecture\"]\nTgtd countries: []\nMlwr families: [\"TinyEgg\", \"ChonkyChicken\", \"ChromEggscalator\", \"TerraStealerV2\", \"TerraLogger\", \"RevC2\"]\nAttack_ids: [\"T1113\", \"T1033\", \"T1056.001\", \"T1123\", \"T1074.001\", \"T1087.002\", \"T1115\", \"T1135\", \"T1082\", \"T1140\", \"T1555\", \"T1021\", \"T1555.003\", \"T1090\", \"T1049\", \"T1528\", \"T1041\", \"T1547.001\", \"T1218.010\", \"T1059.003\", \"T1189\", \"T1071.001\", \"T1018\", \"T1046\", \"T1105\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1785112396", "to_ids": false, "type": "threat-actor", "uuid": "a5c23934-e5e0-405b-9c66-f3a012823b42", "value": "TAG-195", "Tag": [ { "colour": "#bf83fd", "local": false, "name": "misp-galaxy:producer=\"Recorded Future\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Used for OCX payload staging and WebSocket C2", "deleted": false, "disable_correlation": false, "timestamp": "1785120245", "to_ids": true, "type": "domain", "uuid": "2198a186-1292-4bab-a4a7-ad036fffe30e", "value": "xtrafftrck.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ClickFix lure domains are used to induce manual execution of malicious commands", "deleted": false, "disable_correlation": false, "timestamp": "1785120266", "to_ids": true, "type": "domain", "uuid": "3487d797-c11c-4fca-b89f-16bc4ce4fee0", "value": "screenly.cam", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ClickFix lure domains are used to induce manual execution of malicious commands", "deleted": false, "disable_correlation": false, "timestamp": "1785120288", "to_ids": true, "type": "domain", "uuid": "a2b24663-7d89-4500-ad3f-8bd3403756bc", "value": "ahdaratlegalservices.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ClickFix lure domains are used to induce manual execution of malicious commands", "deleted": false, "disable_correlation": false, "timestamp": "1785120309", "to_ids": true, "type": "domain", "uuid": "974ae126-5fe0-4a66-bf03-c38f8e704829", "value": "paysolutions.ink", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ClickFix lure domains are used to induce manual execution of malicious commands", "deleted": false, "disable_correlation": false, "timestamp": "1785120330", "to_ids": true, "type": "domain", "uuid": "acc1b9af-0b15-4f18-b99c-133bc1e2127b", "value": "aurekh.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118342", "to_ids": true, "type": "sha256", "uuid": "16d60351-760b-4e57-a128-c2ba9cb9ac72", "value": "200fbc76bd9fab3b4adcecfe44233cf47146f5709a9735a0232cb4aa7284eadb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118343", "to_ids": true, "type": "sha256", "uuid": "b959ccb6-5f11-4b1c-80e1-42a4ffe0b360", "value": "f3d2ad7440a6f985846710d2dcf0dd2db268dc690837bdf19e4e4e6684483527", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Used for OCX payload staging and WebSocket C2", "deleted": false, "disable_correlation": false, "timestamp": "1785120351", "to_ids": true, "type": "hostname", "uuid": "83363865-f86b-469e-94c2-26596eee1324", "value": "thessa.trackgrid.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Used for OCX payload staging and WebSocket C2", "deleted": false, "disable_correlation": false, "timestamp": "1785120372", "to_ids": true, "type": "ip-dst", "uuid": "40ef3faf-c881-45cd-80f4-ad74c58d6955", "value": "108.61.209.100", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "delivery infrastructure used four lure domains, singel IP", "deleted": false, "disable_correlation": false, "timestamp": "1785120393", "to_ids": true, "type": "ip-dst", "uuid": "ab4b7c17-0a2f-4b98-9742-8f51d2132531", "value": "70.34.205.43", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Used for OCX payload staging and WebSocket C2", "deleted": false, "disable_correlation": false, "timestamp": "1785120414", "to_ids": true, "type": "ip-dst", "uuid": "c8894603-66bd-4a52-ad47-6b562f9d278f", "value": "65.20.102.161", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Used for OCX payload staging and WebSocket C2", "deleted": false, "disable_correlation": false, "timestamp": "1785120436", "to_ids": true, "type": "ip-dst", "uuid": "6783ccfd-6ea7-4951-8f90-1655be8b56b2", "value": "65.20.105.177", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a Sigma rule (or a Sigma rule name).", "meta-category": "misc", "name": "sigma", "template_uuid": "aa21a3cd-ab2c-442a-9999-a5e6626591ec", "template_version": "2", "timestamp": "1785114456", "uuid": "f906ad13-9de1-4d31-93b1-b446469fc183", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sigma-rule-name", "timestamp": "1785114456", "to_ids": false, "type": "text", "uuid": "61e8b4a0-0657-439d-a73f-3dcdddf0b269", "value": "TAG-195 ChonkyChicken lg.txt Temp File Creation" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1785114456", "to_ids": false, "type": "comment", "uuid": "5ee1794c-9da3-434b-99f0-f86c05fd3b01", "value": "Detects creation of the lg.txt debug log in AppData\\\\Local\\\\Temp, which has been observed during TAG-195's ChonkyChicken DllInstall gating and early agent execution." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sigma", "timestamp": "1785114456", "to_ids": true, "type": "sigma", "uuid": "642b8b8f-4ca6-44bd-9b24-be0f66b0a772", "value": "title: TAG-195 ChonkyChicken lg.txt Temp File Creation\r\nid: 1dad7fb5-4faf-47a9-92e5-2e7d796766b8\r\nstatus: stable\r\ndescription: Detects creation of the lg.txt debug log in AppData\\\\Local\\\\Temp, which has been observed during TAG-195's ChonkyChicken DllInstall gating and early agent execution.\r\nreferences:\r\n - sha256:200fbc76bd9fab3b4adcecfe44233cf47146f5709a9735a0232cb4aa7284eadb\r\nauthorL Insikt Group, Recorded Future\r\ndate: 2026-05-14\r\nlogsource:\r\n product: windows\r\n category: file_event\r\ndetection:\r\n chonkychicken_lg_txt_creation:\r\n TargetFilename|endswith: '\\AppData\\Local\\Temp\\lg.txt'\r\n condition: chonkychicken_lg_txt_creation\r\nlevel: high\r\ntags:\r\n - attack.t1074.001 # Local Data Staging\r\nfalsepositives:\r\n - Unlikely" } ] }, { "comment": "", "deleted": false, "description": "An object describing a Sigma rule (or a Sigma rule name).", "meta-category": "misc", "name": "sigma", "template_uuid": "aa21a3cd-ab2c-442a-9999-a5e6626591ec", "template_version": "2", "timestamp": "1785114794", "uuid": "09826def-e925-45ee-bf2c-6d124834751d", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sigma-rule-name", "timestamp": "1785114794", "to_ids": false, "type": "text", "uuid": "97e6e450-57db-436f-9220-0f6ddb83a24e", "value": "TAG-195 ChromEggscalator Execution" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1785114794", "to_ids": false, "type": "comment", "uuid": "e619b6ea-d446-43d0-b78c-3104f3bee625", "value": "Detects execution of the modified Chomelevator browser theft tool used by TAG-195." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sigma", "timestamp": "1785114794", "to_ids": true, "type": "sigma", "uuid": "09d2c44e-abd5-4bab-bcc5-98b45cf0e4c3", "value": "title: TAG-195 ChromEggscalator Execution\r\nid: ae20a8bf-bf7b-436e-900d-b98af919ddc3\r\nstatus: stable\r\ndescription: Detects execution of the modified Chomelevator browser theft tool used by TAG-195.\r\nreferences:\r\n - Internal research\r\nauthor: Insikt Group, Recorded Future\r\ndate: 2026-04-27\r\nlevel: high\r\ntags:\r\n - attack.t1555.003 # Credentials From Password Stores: Credentials From Web Browsers Execution\r\n - attack.t1218.010 # System Binary Proxy Execution: Regsvr32\r\nlogsource:\r\n product: windows\r\n category: process_creation\r\ndetection:\r\n command:\r\n CommandLine|contains|all:\r\n - 'regsvr32'\r\n - '\\chromelevator.ocx'\r\n condition: command\r\nfalsepositives:\r\n - Unlikely" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1785115491", "uuid": "966e4738-19b8-4021-b201-cbaba691c055", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1785115491", "to_ids": false, "type": "text", "uuid": "98d07e28-1271-436e-84bf-77923be3cc66", "value": "MAL_TAG195_ChonkyChicken" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1785115491", "to_ids": false, "type": "comment", "uuid": "ed4f2abd-ba7a-436f-992d-103d5ba4c226", "value": "Detects ChonkyChicken used by TAG-195" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1785115491", "to_ids": true, "type": "yara", "uuid": "63edafd9-a230-43c6-8f2f-87a869fceff8", "value": "rule MAL_TAG195_ChonkyChicken\r\n{\r\n meta:\r\n author = \"Insikt Group, Recorded Future\"\r\n date = \"2026-05-14\"\r\n description = \"Detects ChonkyChicken used by TAG-195.\"\r\n version = \"1.0\"\r\n reference = \"https://tria.ge/260428-mhxf1agt7w\"\r\n hash = \"5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c\"\r\n\r\n strings:\r\n $s1 = \"Koki cmd=[\"\r\n $s2 = \"Blat path=[\"\r\n $s3 = \"lg.txt\" fullword\r\n $s4 = \"wpad_capture.ocx\" fullword\r\n $s5 = \"output\\\\hashes.json\"\r\n $s6 = \"schtasks /create /s \"\r\n $s7 = \"token_run\" fullword\r\n $s8 = \"whoami\" fullword\r\n $s9 = \"chrome_ready\" fullword\r\n $s10 = \"chrome_result\" fullword\r\n $s11 = \"cdp_send\" fullword\r\n $s12 = \"cred_exec\" fullword\r\n\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n all of ($s*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120457", "uuid": "65eef159-54bd-422a-b8c5-f560beb66def", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "md5", "timestamp": "1785120457", "to_ids": true, "type": "md5", "uuid": "0e176f94-d40d-4566-bc02-7a67a8b86127", "value": "9994e7cf70cbedf528fd91887b265d05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "sha1", "timestamp": "1785118309", "to_ids": true, "type": "sha1", "uuid": "90450eb8-1ab5-4671-98dc-41d1b6f7087a", "value": "5e673d4397cb46c2f9650a06ca2a94e4a94db926", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "sha256", "timestamp": "1785118309", "to_ids": true, "type": "sha256", "uuid": "6cf1111a-b541-4bbf-a82b-4123e5f19bc2", "value": "6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 27/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "text", "timestamp": "1785117244", "to_ids": false, "type": "text", "uuid": "c6dee6e5-47d9-452b-96c6-e1a6661abb9a", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 41/74\nFirst Submission: 2026-04-20T05:51:55+00:00\nLast Submission: 2026-06-04T07:24:07+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "creation-time", "timestamp": "1785117244", "to_ids": false, "type": "datetime", "uuid": "48df3430-4e0f-4286-a85a-2f666a47949c", "value": "2020-10-16T15:52:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "ssdeep", "timestamp": "1785117244", "to_ids": true, "type": "ssdeep", "uuid": "004f22ba-4678-4d9f-9bf9-8ce512480a8f", "value": "24576:o3aOWrKyPojLoqb+B+wvrdGlYELCK6zLX5C1ySGObPC5sX+LAu:YaOsPojLoqqB+wvRGlYELCK6zUn62" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117244", "to_ids": false, "type": "size-in-bytes", "uuid": "d91189de-51e4-4132-aa46-cfb8c2577ad0", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "vhash", "timestamp": "1785117244", "to_ids": true, "type": "vhash", "uuid": "8c0d52cc-da3b-4bb8-ae60-033e9bec9388", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T05:51:55+00:00", "last_seen": "2026-06-04T07:24:07+00:00", "object_relation": "filename", "timestamp": "1785117244", "to_ids": true, "type": "filename", "uuid": "8843b15b-cbbe-4ad5-b51d-ad65bb66daa5", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120478", "uuid": "401a7cb0-d895-435a-9bf4-49df64814dbd", "Attribute": [ { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "md5", "timestamp": "1785120478", "to_ids": true, "type": "md5", "uuid": "a35d306c-9dfa-4217-97f7-b27e5363af73", "value": "960688e3484eb744cdbbee55a7415bd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "sha1", "timestamp": "1785118310", "to_ids": true, "type": "sha1", "uuid": "e5082d64-2cbb-4a6f-921c-eff12c37ebcb", "value": "d48d1a4dfb6d015df1ee019ea70ec59137c4b948", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "sha256", "timestamp": "1785118310", "to_ids": true, "type": "sha256", "uuid": "801db557-b573-46cb-8e09-e97892b211dc", "value": "b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "text", "timestamp": "1785117265", "to_ids": false, "type": "text", "uuid": "272737ac-a336-4105-ade2-6bf6cb643d70", "value": "ChromEggscalator\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Seen In The Wild: 2026-03-31T13:24:56+00:00\nFirst Submission: 2026-04-27T18:15:30+00:00\nLast Submission: 2026-05-16T20:28:21+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "creation-time", "timestamp": "1785117266", "to_ids": false, "type": "datetime", "uuid": "897c87b9-9ba4-4ab8-acb7-ed4d3c24b16b", "value": "2026-03-31T12:48:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "ssdeep", "timestamp": "1785117265", "to_ids": true, "type": "ssdeep", "uuid": "fa12e86c-7891-489f-a4b7-055c57edaadc", "value": "24576:PApmA5EfyV89e1Cn9Gdo4DzUw4UKLmrK4LUKFVQxvzCu+gcSlnbSEN5:I0zfnCdPvLcIUKFVkeQvlnbS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117265", "to_ids": false, "type": "size-in-bytes", "uuid": "6ebcf741-b88d-4dc2-bc09-216d39dce9ec", "value": "1462272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "vhash", "timestamp": "1785117265", "to_ids": true, "type": "vhash", "uuid": "f80ac03c-d1af-402e-b6a2-23dc06ce8093", "value": "1160667d15555d055az6dpz3cz1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T18:15:30+00:00", "last_seen": "2026-05-16T20:28:21+00:00", "object_relation": "filename", "timestamp": "1785117265", "to_ids": true, "type": "filename", "uuid": "76bda62d-a799-417c-a6d7-2116622eccaa", "value": "chromelevator.ocx" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120499", "uuid": "2728f47a-b556-4e15-8215-134ae294176a", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "md5", "timestamp": "1785120499", "to_ids": true, "type": "md5", "uuid": "77434b1f-4884-4cd8-a223-c242a968bc0a", "value": "7c6e4a085b1fd9b98407ba4400f91201", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "sha1", "timestamp": "1785118311", "to_ids": true, "type": "sha1", "uuid": "5e642626-ff45-412f-a794-c750665fc42a", "value": "39b3b4bb7a1b45cc155e0f8a7149df393e98b2b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "sha256", "timestamp": "1785118311", "to_ids": true, "type": "sha256", "uuid": "7ed8611e-bd14-4e7c-ae5f-bd8ada46ea61", "value": "45c8cbaeb5c7708e7b8030e701747c65203958e82eddc41f39e0ca93bd36c114", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "text", "timestamp": "1785117287", "to_ids": false, "type": "text", "uuid": "8bb6b991-f8fc-4740-82a1-7dc09fea619e", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-04-03T16:20:37+00:00\nFirst Submission: 2026-04-27T18:26:31+00:00\nLast Submission: 2026-05-16T20:28:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "creation-time", "timestamp": "1785117287", "to_ids": false, "type": "datetime", "uuid": "7e206c9b-08b2-41f0-925f-837cbf13461a", "value": "2026-04-03T11:28:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "ssdeep", "timestamp": "1785117287", "to_ids": true, "type": "ssdeep", "uuid": "1458ad66-8d85-4797-ab73-fec270f87653", "value": "49152:CTQ3/paP7NsgipvA0F892cWN6yGItk1pQgn5e0QU7UO9Jb:CTQmpU2A6yU1pQgn5v9Jb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117287", "to_ids": false, "type": "size-in-bytes", "uuid": "c32c414f-fb83-4dad-8317-ac389a66f801", "value": "3977216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "vhash", "timestamp": "1785117287", "to_ids": true, "type": "vhash", "uuid": "a290b2a0-69e7-4cee-9b3e-ff1dc21c960a", "value": "1360b76d1555655c051d514z409006b720fjzd3z7226z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T18:26:31+00:00", "last_seen": "2026-05-16T20:28:18+00:00", "object_relation": "filename", "timestamp": "1785117287", "to_ids": true, "type": "filename", "uuid": "32efccf6-43e4-4dba-8365-95c1ecff8798", "value": "mscomer.ocx" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120520", "uuid": "4a99a752-0679-4023-b077-a262dcc74139", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "md5", "timestamp": "1785120520", "to_ids": true, "type": "md5", "uuid": "5782b7f2-e7f4-4681-8e0c-d260d24b9682", "value": "7a0edeb5bebc51de8ce455f38d9a7670", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "sha1", "timestamp": "1785118312", "to_ids": true, "type": "sha1", "uuid": "8aa8ad61-4fbe-4c9f-bd22-146e3e4c6136", "value": "c6c299162eae50a1d76ee9f6d42f60cef464fa04", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "sha256", "timestamp": "1785118312", "to_ids": true, "type": "sha256", "uuid": "a7687a9c-54ab-4639-a36d-dd7bc0035bf7", "value": "d2e1ab10d5a0c16a724aeda8acb46b38f551ade58137969c3bc3c9cdc0a12425", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "text", "timestamp": "1785117308", "to_ids": false, "type": "text", "uuid": "f3b1002d-6242-4149-ae04-0490c317959c", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2026-04-27T13:35:39+00:00\nLast Submission: 2026-06-04T07:08:48+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "creation-time", "timestamp": "1785117308", "to_ids": false, "type": "datetime", "uuid": "a218b062-6614-4de6-88ca-16eec24bf844", "value": "2023-06-18T04:11:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "ssdeep", "timestamp": "1785117308", "to_ids": true, "type": "ssdeep", "uuid": "dd4ebff0-d1f6-48b0-b70b-732cc49ccaf3", "value": "24576:J3aOWrKyPojLAqbJWcpBFLlYEL3QfiDkXYw6kNObPoAiGCf1rAT:paOsPojLAq1WcpzLlYELAfiDs3r5V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117308", "to_ids": false, "type": "size-in-bytes", "uuid": "2eea99f9-a8c4-483e-9f37-c0ad693a3117", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "vhash", "timestamp": "1785117308", "to_ids": true, "type": "vhash", "uuid": "38fc3fc6-1cbb-4a1f-857c-86fcf255d85e", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:35:39+00:00", "last_seen": "2026-06-04T07:08:48+00:00", "object_relation": "filename", "timestamp": "1785117308", "to_ids": true, "type": "filename", "uuid": "62e835b6-a31b-4510-9bfc-b7c40e8696b8", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120542", "uuid": "059cf1ef-bbb8-47b7-b711-5ed2c0dbd4ba", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "md5", "timestamp": "1785120542", "to_ids": true, "type": "md5", "uuid": "bbdd11cc-6c97-41ae-9e3f-ccfa2579c58a", "value": "70983540817fd9ff46204001a7b35ba0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "sha1", "timestamp": "1785118313", "to_ids": true, "type": "sha1", "uuid": "0c64a93b-4500-4a06-8cb7-c774ea28a7d5", "value": "5c50a13f91b0c5a109c96628e2e35f86a2c3d6c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "sha256", "timestamp": "1785118313", "to_ids": true, "type": "sha256", "uuid": "58cefc71-2477-49f6-9998-9989314fd6fd", "value": "5cae5202ddcc29f19f954d81ba138f11b8a4080d05fef63c05a00b9242c06967", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "text", "timestamp": "1785117330", "to_ids": false, "type": "text", "uuid": "851a465d-f3c8-40a9-835c-ed084e9be81c", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2026-05-15T10:12:02+00:00\nFirst Submission: 2026-05-14T20:54:40+00:00\nLast Submission: 2026-05-18T13:31:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "creation-time", "timestamp": "1785117330", "to_ids": false, "type": "datetime", "uuid": "de6d4cbe-3ab2-422f-a220-9c5598fd611a", "value": "2019-09-19T23:43:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "ssdeep", "timestamp": "1785117330", "to_ids": true, "type": "ssdeep", "uuid": "c5023d1e-48de-4686-b32b-46b2a61f4f8c", "value": "24576:zc3aOWrKyPojLRqbFkGC1x3rF4/rUld7p7+FOfO7vKygrmugE:zEaOsPojLRqpkGC1drF4/rUldIAr1r" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117330", "to_ids": false, "type": "size-in-bytes", "uuid": "67cf0da0-0662-4821-8a0f-9cf308da9ec4", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "vhash", "timestamp": "1785117330", "to_ids": true, "type": "vhash", "uuid": "5bc897c6-8c3d-4a3b-b7db-9e348cb9125f", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T20:54:40+00:00", "last_seen": "2026-05-18T13:31:30+00:00", "object_relation": "filename", "timestamp": "1785117330", "to_ids": true, "type": "filename", "uuid": "4cae4e56-28d3-4ee7-9631-23747d03e0f1", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120563", "uuid": "98c4aa2f-1dee-4ca5-b11d-7837f648ccad", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "md5", "timestamp": "1785120563", "to_ids": true, "type": "md5", "uuid": "6213855d-a9ca-43d9-9ade-afd104dc28c0", "value": "9d6f7697c0fbea55d6bfb39642eb87df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "sha1", "timestamp": "1785118314", "to_ids": true, "type": "sha1", "uuid": "4dcb9c12-29e0-4775-8ab3-b7d8f1cd8c40", "value": "2b57771989fc059bbef8f28fc0ca24eeae7e7863", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "sha256", "timestamp": "1785118314", "to_ids": true, "type": "sha256", "uuid": "c45e7d64-6c0b-4490-9f86-06f46328424b", "value": "9a2d714ddd5c48722c35df8a70e97f12d46bcde05dc79b7242a7e692bd346826", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "text", "timestamp": "1785117351", "to_ids": false, "type": "text", "uuid": "e3605f8d-ac1f-4ba6-ba8d-c6676b364b6e", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-05-16T21:03:22+00:00\nFirst Submission: 2026-05-16T20:28:38+00:00\nLast Submission: 2026-06-14T01:02:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "creation-time", "timestamp": "1785117351", "to_ids": false, "type": "datetime", "uuid": "ab856a23-7815-47df-a80c-acc99a918952", "value": "2026-05-01T08:56:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "ssdeep", "timestamp": "1785117351", "to_ids": true, "type": "ssdeep", "uuid": "a64327f1-d418-41c4-8f0c-e438d00d9272", "value": "49152:1TUQypeO03NvTEh5/wWT8qpQ/fnlRG1mlSKsj1WPjXIQIt:1sIC18nl7SKsj1Wa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117351", "to_ids": false, "type": "size-in-bytes", "uuid": "088247f9-52e8-4de6-a581-c1f04da41156", "value": "4012032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "vhash", "timestamp": "1785117351", "to_ids": true, "type": "vhash", "uuid": "b2d0cb45-ee42-4b4a-a8e8-2a208976f0ac", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:38+00:00", "last_seen": "2026-06-14T01:02:09+00:00", "object_relation": "filename", "timestamp": "1785117351", "to_ids": true, "type": "filename", "uuid": "1e600ea4-5ccf-4a8a-91e1-f4a86fe147f1", "value": "9a2d714ddd5c48722c35df8a70e97f12d46bcde05dc79b7242a7e692bd346826.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120584", "uuid": "611b4228-150b-43d6-9349-1583eb7fc8c3", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "md5", "timestamp": "1785120584", "to_ids": true, "type": "md5", "uuid": "d0d58692-2dbb-4a39-8d75-2037d2ff6324", "value": "c21f69bbf1f78ebf4f1aa784cee035ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "sha1", "timestamp": "1785118315", "to_ids": true, "type": "sha1", "uuid": "e1ca949e-39c9-4fa2-96a5-69d7c854a167", "value": "06eade11e16465edef89ba0199d7d6f8c18a3200", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "sha256", "timestamp": "1785118315", "to_ids": true, "type": "sha256", "uuid": "730152e7-f4e5-4c26-bd08-7ff16a170c87", "value": "6c7619c34497f430c4f7618cfefe07d1defacfae48f6730c20f52e7a7344faa9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "text", "timestamp": "1785117373", "to_ids": false, "type": "text", "uuid": "49d01078-87db-44ae-945e-110ae6d90aa4", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Seen In The Wild: 2026-05-16T21:03:21+00:00\nFirst Submission: 2026-05-16T20:28:23+00:00\nLast Submission: 2026-06-14T01:01:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "creation-time", "timestamp": "1785117373", "to_ids": false, "type": "datetime", "uuid": "b0f7311e-4ab7-4488-899c-28fd624c66a8", "value": "2026-05-15T12:17:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "ssdeep", "timestamp": "1785117373", "to_ids": true, "type": "ssdeep", "uuid": "aaba2c48-87e4-4590-b176-b2ab4924f5fc", "value": "49152:CwsgLNYLLAumkKrfB3d2eghdEMEWXOKkidRaN4+dohZndiT2xj:jipgB9WXOyRaN4+d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117373", "to_ids": false, "type": "size-in-bytes", "uuid": "986f22f0-2807-4aca-a3d9-dd66032d79ec", "value": "4013568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "vhash", "timestamp": "1785117373", "to_ids": true, "type": "vhash", "uuid": "0b62679e-8881-4afe-aa81-ed53de3395d2", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:23+00:00", "last_seen": "2026-06-14T01:01:55+00:00", "object_relation": "filename", "timestamp": "1785117373", "to_ids": true, "type": "filename", "uuid": "b52bc478-13e6-4262-8c6a-c406d4277910", "value": "6c7619c34497f430c4f7618cfefe07d1defacfae48f6730c20f52e7a7344faa9.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120605", "uuid": "78497b73-e5c6-457e-94a1-09cd845095e9", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "md5", "timestamp": "1785120605", "to_ids": true, "type": "md5", "uuid": "031aad1b-6439-46e5-9631-b9bfea600d79", "value": "f23cb60ab395cc6bf931eed16b801ed7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "sha1", "timestamp": "1785118317", "to_ids": true, "type": "sha1", "uuid": "7b7ca7e9-7143-4313-ac7c-01ee5c0996c7", "value": "c5d8601c7b65a584696fe63e8817b395414bc1ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "sha256", "timestamp": "1785118317", "to_ids": true, "type": "sha256", "uuid": "7cdaa54c-c162-494e-b859-7771e2d8cf72", "value": "41aa04782e436345ef45dc159321d5c0e0e5cba300e55a4d1d3194e5c7c5fd97", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "text", "timestamp": "1785117394", "to_ids": false, "type": "text", "uuid": "be2850e7-f960-4fd3-adf7-1e26400b0ac5", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 23/74\nFirst Seen In The Wild: 2026-05-16T21:03:17+00:00\nFirst Submission: 2026-05-16T20:28:14+00:00\nLast Submission: 2026-06-14T01:02:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "creation-time", "timestamp": "1785117394", "to_ids": false, "type": "datetime", "uuid": "41d78ad2-c04f-4d18-b715-f1a4c06266b6", "value": "2026-05-16T09:45:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "ssdeep", "timestamp": "1785117394", "to_ids": true, "type": "ssdeep", "uuid": "75d0545f-7bb0-4357-a7b6-177301464473", "value": "49152:PnbOPNYLLAumkKrfB3d2eghdEMEWXCKiiLRaN4+dohVxdVTGx8:fZpgB9WXCaRaN4+d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117394", "to_ids": false, "type": "size-in-bytes", "uuid": "12b2291e-6d29-4035-afe8-9d3b7ba554ab", "value": "4013568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "vhash", "timestamp": "1785117394", "to_ids": true, "type": "vhash", "uuid": "b77ee0ae-901b-4050-8ca1-627b296878c1", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:14+00:00", "last_seen": "2026-06-14T01:02:25+00:00", "object_relation": "filename", "timestamp": "1785117394", "to_ids": true, "type": "filename", "uuid": "5225d3af-9f7c-4768-b7aa-a9a4346eb3fd", "value": "41aa04782e436345ef45dc159321d5c0e0e5cba300e55a4d1d3194e5c7c5fd97.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120626", "uuid": "4e4a644c-8034-44a6-a58c-f2d705407a6a", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "md5", "timestamp": "1785120626", "to_ids": true, "type": "md5", "uuid": "b1fb3371-97a5-4fb1-b50a-34349bb71b5a", "value": "03713176e7f0d9f3b37ac6eb644d90bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "sha1", "timestamp": "1785118318", "to_ids": true, "type": "sha1", "uuid": "1171b072-9ed7-48f6-805a-63d30fa9211b", "value": "813cd8a638b4d5cde58bdf8df7c02260a404802c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "sha256", "timestamp": "1785118318", "to_ids": true, "type": "sha256", "uuid": "583bf9d0-4fd6-44de-8094-1ff224c5ca8e", "value": "d5dea9a51b984be9d7fa76e3e8ff89cfb97c335927331e8e348b9ee269070c1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "text", "timestamp": "1785117416", "to_ids": false, "type": "text", "uuid": "5d2642a0-103c-454f-9a96-e1d9793ab64f", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2026-05-16T21:03:28+00:00\nFirst Submission: 2026-05-16T20:28:34+00:00\nLast Submission: 2026-06-14T01:07:44+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "creation-time", "timestamp": "1785117416", "to_ids": false, "type": "datetime", "uuid": "ee9aeede-bee2-4342-a6ce-bca4d0470a86", "value": "2026-05-03T08:03:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "ssdeep", "timestamp": "1785117416", "to_ids": true, "type": "ssdeep", "uuid": "67f3d03a-f48e-44ad-93a9-6c85e75f9911", "value": "49152:Ig5ampeO03NvTEh5/wWT8qpQ/fnlhyBm5SKsj1WPAX0QHF:IWIC18nlfSKsj1W8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117416", "to_ids": false, "type": "size-in-bytes", "uuid": "bf54552f-d38c-4734-b5fc-38f6c2c3b8b9", "value": "4012032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "vhash", "timestamp": "1785117416", "to_ids": true, "type": "vhash", "uuid": "b0047bcc-8e40-432d-95e5-9ba0af01d01a", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:34+00:00", "last_seen": "2026-06-14T01:07:44+00:00", "object_relation": "filename", "timestamp": "1785117416", "to_ids": true, "type": "filename", "uuid": "5a3fa51b-c3c0-413b-b26c-a6054f703f16", "value": "d5dea9a51b984be9d7fa76e3e8ff89cfb97c335927331e8e348b9ee269070c1b.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120647", "uuid": "7359b689-bd11-4c95-a7c2-1e0e47b15e08", "Attribute": [ { "category": "Payload delivery", "comment": "Modular ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "md5", "timestamp": "1785120647", "to_ids": true, "type": "md5", "uuid": "c7069c49-a194-40a2-b763-1354e53ced22", "value": "2cf627a0a9d64db3e4cd13fda3ce5636", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Modular ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "sha1", "timestamp": "1785118319", "to_ids": true, "type": "sha1", "uuid": "bbafff92-f9a5-4ad2-b6c7-3ca9e32ec5c1", "value": "10f6effed5a4dfff9b6e94ea90bc2134510f770f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Modular ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "sha256", "timestamp": "1785118319", "to_ids": true, "type": "sha256", "uuid": "3e4b3bc1-961e-4616-8a0d-fa550b31583c", "value": "16735cb80d796865b2430aa11d21a539fcb00b027932f2c63e4b5c098d26585b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "text", "timestamp": "1785117437", "to_ids": false, "type": "text", "uuid": "1badcae6-3149-48c3-9cbf-9418db472a4d", "value": "Modular ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 38/74\nFirst Seen In The Wild: 2026-05-16T21:02:35+00:00\nFirst Submission: 2026-05-16T20:28:25+00:00\nLast Submission: 2026-05-18T13:44:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "creation-time", "timestamp": "1785117437", "to_ids": false, "type": "datetime", "uuid": "afe22e3e-3e32-4081-8f57-dbf484fa566d", "value": "2026-05-12T05:27:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "ssdeep", "timestamp": "1785117437", "to_ids": true, "type": "ssdeep", "uuid": "846f92fa-a8bb-4257-9f88-a42d60c3e0f6", "value": "49152:gYi3KduJsIJTufVFbw+VqZRY3hzho5Tf:+juI+VqZRY3S" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117437", "to_ids": false, "type": "size-in-bytes", "uuid": "a18741ac-e20b-4ef2-b56d-eb08385bbcc7", "value": "2331136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "vhash", "timestamp": "1785117437", "to_ids": true, "type": "vhash", "uuid": "b58fb951-48c0-444b-8f90-2c57b31a6609", "value": "1260b76d1555655c051d1013z42z4458sz1d6z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:25+00:00", "last_seen": "2026-05-18T13:44:55+00:00", "object_relation": "filename", "timestamp": "1785117437", "to_ids": true, "type": "filename", "uuid": "aa8b3856-d9bd-40a6-b7ea-a30ac49979a1", "value": "m0f17jm9.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120668", "uuid": "a010141d-7c77-4909-aaa9-83fffde1c873", "Attribute": [ { "category": "Payload delivery", "comment": "Modular ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "md5", "timestamp": "1785120668", "to_ids": true, "type": "md5", "uuid": "6659510d-76b6-4233-881a-2349cda42abd", "value": "396d4f44e429e7128af9c02e0c1bdf99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Modular ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "sha1", "timestamp": "1785118320", "to_ids": true, "type": "sha1", "uuid": "1990b794-f1b1-4c50-90c2-007ff8cea978", "value": "d810f563443e8f11478937bfcf20ff178d45eedb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Modular ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "sha256", "timestamp": "1785118321", "to_ids": true, "type": "sha256", "uuid": "481ab27f-0852-48ea-8916-691a901cc18f", "value": "e3153ced59bb0376186b0eee0ec68f0b5aa9ae5820ef8508ae4e67625e1a3581", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "text", "timestamp": "1785117459", "to_ids": false, "type": "text", "uuid": "789f0e1e-778b-4c60-89e3-6aca199eb865", "value": "Modular ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 39/74\nFirst Seen In The Wild: 2026-05-16T21:02:33+00:00\nFirst Submission: 2026-05-16T20:28:28+00:00\nLast Submission: 2026-05-18T13:53:39+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "creation-time", "timestamp": "1785117459", "to_ids": false, "type": "datetime", "uuid": "387dc378-4a1f-4872-a6e2-6058c5177a15", "value": "2026-05-01T09:00:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "ssdeep", "timestamp": "1785117459", "to_ids": true, "type": "ssdeep", "uuid": "d4bd6aaa-a0c8-4f64-b129-c0c2a34d3b2a", "value": "49152:hP/Q3KduJsIJTu0obg+VqZRY3hdhog+4:QjuM+VqZRY3x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117459", "to_ids": false, "type": "size-in-bytes", "uuid": "560edb5f-369a-4fe4-a434-b08970b5f720", "value": "2331136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "vhash", "timestamp": "1785117459", "to_ids": true, "type": "vhash", "uuid": "1bfc7fc9-49fa-4dc8-8e02-b82f6c687736", "value": "1260b76d1555655c051d1013z42z4458sz1d6z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T20:28:28+00:00", "last_seen": "2026-05-18T13:53:39+00:00", "object_relation": "filename", "timestamp": "1785117459", "to_ids": true, "type": "filename", "uuid": "d4778434-8338-4346-8883-df714ec7b374", "value": "e3153ced59bb0376186b0eee0ec68f0b5aa9ae5820ef8508ae4e67625e1a3581.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120689", "uuid": "91339771-8b32-4167-a15b-d75d934a2b1e", "Attribute": [ { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "md5", "timestamp": "1785120689", "to_ids": true, "type": "md5", "uuid": "4cfa07fe-e191-43a5-9c34-25481a0ffd2d", "value": "210f57e3b1c88447ddc11467f7b2fbb9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "sha1", "timestamp": "1785118322", "to_ids": true, "type": "sha1", "uuid": "ad3742e7-af08-4ed3-95a1-75eb34c523a5", "value": "72e488857a6c6c659c0c673f0e4c32a610ea41ee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "sha256", "timestamp": "1785118322", "to_ids": true, "type": "sha256", "uuid": "736f0622-25af-424c-be74-453657768f29", "value": "6922b319dc96d020738bcf466c4d6d9233e4767b68592e1fd9258a232f166ce1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "text", "timestamp": "1785117480", "to_ids": false, "type": "text", "uuid": "628ea40b-f44b-40c4-9540-e5e647086a4b", "value": "ChromEggscalator\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2026-05-27T21:00:59+00:00\nFirst Submission: 2026-05-27T20:16:02+00:00\nLast Submission: 2026-05-27T20:16:02+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "creation-time", "timestamp": "1785117480", "to_ids": false, "type": "datetime", "uuid": "181378cb-c78f-449a-8488-bf5762c6b7ea", "value": "2026-05-26T16:07:40+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "ssdeep", "timestamp": "1785117480", "to_ids": true, "type": "ssdeep", "uuid": "bcfba918-97cb-460c-ac0b-aa8e9a4e71a5", "value": "24576:ZKgkqG+F4Oq02+5ugus16qUkxS/G2bV2AOtoVxjit4uCRK:Y99O2+IgXzmG2bV2AOtoV5iuu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117480", "to_ids": false, "type": "size-in-bytes", "uuid": "cf0bb8d4-51ce-4d4e-b9f0-8a4064efb3e8", "value": "1462272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "vhash", "timestamp": "1785117480", "to_ids": true, "type": "vhash", "uuid": "437c3b78-3806-4eaa-a568-8d0bac8caac4", "value": "1160667d15555d055az6dpz3cz1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T20:16:02+00:00", "last_seen": "2026-05-27T20:16:02+00:00", "object_relation": "filename", "timestamp": "1785117480", "to_ids": true, "type": "filename", "uuid": "ef1aceea-fe94-4f4a-8eac-d20465c647f9", "value": "6922b319dc96d020738bcf466c4d6d9233e4767b68592e1fd9258a232f166ce1.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120710", "uuid": "6cc925ee-cb89-4a55-a278-751731a7393e", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "md5", "timestamp": "1785120710", "to_ids": true, "type": "md5", "uuid": "053d13ab-67cb-4844-a736-ea8fa943440d", "value": "321b615e2881f74de9b819d5dc4a7560", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "sha1", "timestamp": "1785118323", "to_ids": true, "type": "sha1", "uuid": "24411377-3a01-4e75-8a40-4c319fcf477e", "value": "ae98585e0531ea885a7d6e69d2b03c33b1d91997", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "sha256", "timestamp": "1785118324", "to_ids": true, "type": "sha256", "uuid": "95b7a2ce-2963-453e-ada1-673c2c663f88", "value": "086273cd91f3d6556ed2af915df310e4b184b3db84c3903aa09830d49d1fbb62", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "text", "timestamp": "1785117501", "to_ids": false, "type": "text", "uuid": "ffffeb7b-100f-469f-86a3-ae569ae46a59", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-05-11T17:17:42+00:00\nLast Submission: 2026-05-11T17:17:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "creation-time", "timestamp": "1785117502", "to_ids": false, "type": "datetime", "uuid": "10d3f7a2-0666-4577-8136-81aa2871af20", "value": "2022-08-23T22:30:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "ssdeep", "timestamp": "1785117501", "to_ids": true, "type": "ssdeep", "uuid": "3dfa6365-e53a-40d6-b330-bdb89b8b8755", "value": "24576:KT693aOWrKyPojLxqbzX2zizLIffEym/MDpAhPSXOIg1QcG/OdR:qYaOsPojLxqXX2zqLIffEy0/6an" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117501", "to_ids": false, "type": "size-in-bytes", "uuid": "f381733b-df83-4b33-b973-f282fd7e8664", "value": "2231808" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "vhash", "timestamp": "1785117501", "to_ids": true, "type": "vhash", "uuid": "4ed5402d-278b-4780-9316-97bdbac3ca93", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-11T17:17:42+00:00", "last_seen": "2026-05-11T17:17:42+00:00", "object_relation": "filename", "timestamp": "1785117501", "to_ids": true, "type": "filename", "uuid": "9d684342-273a-427c-ac84-a23d73fc82f0", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120731", "uuid": "3fdc59a1-ba91-4f88-8778-cdce211b0a02", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "md5", "timestamp": "1785120731", "to_ids": true, "type": "md5", "uuid": "ba676f36-7466-4702-92c0-e2dfc4816eec", "value": "60992cdeb88dddfb17e12573e4436c42", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "sha1", "timestamp": "1785118324", "to_ids": true, "type": "sha1", "uuid": "e8d689a9-b55b-4739-943d-a96013a7b73c", "value": "49d8bcb15cbf235a1a5f5d81a5ed4e1045b2d90a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "sha256", "timestamp": "1785118324", "to_ids": true, "type": "sha256", "uuid": "edd141d5-804f-4d36-91a4-219bc64e7d72", "value": "3250adbca0a0bfeab8bd88ee93b603be31fc86b341fd77a152b4843416560d53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "text", "timestamp": "1785117544", "to_ids": false, "type": "text", "uuid": "98ec64aa-78b7-4a24-9632-488c41a98ad4", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-04-29T12:12:30+00:00\nLast Submission: 2026-04-29T12:12:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "creation-time", "timestamp": "1785117544", "to_ids": false, "type": "datetime", "uuid": "6eff72db-1269-4250-9a35-3f35c59213d0", "value": "2022-09-05T16:26:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "ssdeep", "timestamp": "1785117544", "to_ids": true, "type": "ssdeep", "uuid": "a4f290cc-b3c7-46cd-a823-fffaed83f2fa", "value": "24576:te3aOWrKyPojLIqbSN1T47rF4krmL/WXdfj7+5O7vkGPZag7:waOsPojLIq2N1TkrF4krmL/0H+HuZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117544", "to_ids": false, "type": "size-in-bytes", "uuid": "73894113-2b57-4cae-814c-1448bfe398b6", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "vhash", "timestamp": "1785117544", "to_ids": true, "type": "vhash", "uuid": "48d52f6e-2446-494f-bcac-94bbbb99b81a", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T12:12:30+00:00", "last_seen": "2026-04-29T12:12:30+00:00", "object_relation": "filename", "timestamp": "1785117544", "to_ids": true, "type": "filename", "uuid": "cd0532bc-395a-4e2f-8f03-3316445d4d53", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120753", "uuid": "6ded8d59-4d82-499c-bceb-7076e6b50de9", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "md5", "timestamp": "1785120753", "to_ids": true, "type": "md5", "uuid": "197e9ecc-163a-425a-b50f-efc17fb62559", "value": "2cc1ec080f7e1fcd2c0c6ae033b988c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "sha1", "timestamp": "1785118326", "to_ids": true, "type": "sha1", "uuid": "6f1c535f-0b24-47b4-899a-8d29234397a2", "value": "6a29c8ebd0c77e5655c39963df9c86ca9c145d08", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "sha256", "timestamp": "1785118326", "to_ids": true, "type": "sha256", "uuid": "4e5a7d0b-bfdc-4cc2-a562-a49462c14258", "value": "337e92c233edc38842c6122fa38e0e84a478f5aa5af2a95ca6be3ca056d925b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "text", "timestamp": "1785117565", "to_ids": false, "type": "text", "uuid": "83b339c6-bf1e-404f-b6d7-14887150ba48", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2026-05-20T17:01:43+00:00\nFirst Submission: 2026-05-20T16:54:36+00:00\nLast Submission: 2026-05-20T16:54:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "creation-time", "timestamp": "1785117565", "to_ids": false, "type": "datetime", "uuid": "826a98b6-00a6-4fc6-936a-a2269c7021e1", "value": "2026-05-19T10:22:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "ssdeep", "timestamp": "1785117565", "to_ids": true, "type": "ssdeep", "uuid": "aa72cfc5-664a-45ba-83f3-15a50b9ef37e", "value": "49152:H++6OvH+8GcD4lFxeNZLoBewXvAva8L28q971LKYIAaOkUPyp:EdDUL0hIZL2H1LKYIA/A" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117565", "to_ids": false, "type": "size-in-bytes", "uuid": "616ae640-ea47-4865-9eac-910d22791d98", "value": "3528704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "vhash", "timestamp": "1785117565", "to_ids": true, "type": "vhash", "uuid": "689f3557-b040-45e8-8338-71683f3020e2", "value": "1360b76d1555655c051d514z409007c790fjzd3z7226z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T16:54:36+00:00", "last_seen": "2026-05-20T16:54:36+00:00", "object_relation": "filename", "timestamp": "1785117565", "to_ids": true, "type": "filename", "uuid": "6a3ab4af-ada7-4907-94fc-db99849454cb", "value": "mscomctl.ocx" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120774", "uuid": "8d14c6c7-420b-4bb8-8b06-e88cc736cceb", "Attribute": [ { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "md5", "timestamp": "1785120774", "to_ids": true, "type": "md5", "uuid": "9088ab3c-6ade-440d-a389-16d03ef6c8de", "value": "e4ee5ed330eaa0602f4f637f5567d08e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "sha1", "timestamp": "1785118327", "to_ids": true, "type": "sha1", "uuid": "fc7e35e6-383c-429f-bcd8-cdee3fbe5b21", "value": "3ea1ccbd98c3fa8ed5cc23642ef5db39e900d88b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "sha256", "timestamp": "1785118327", "to_ids": true, "type": "sha256", "uuid": "2f2b5bd6-91a7-46f8-9e61-59ba8d79eb55", "value": "33a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "text", "timestamp": "1785117587", "to_ids": false, "type": "text", "uuid": "dbc89885-2267-4eb4-bd3b-21605489d79c", "value": "ChromEggscalator\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2026-05-20T17:01:31+00:00\nFirst Submission: 2026-05-20T16:54:28+00:00\nLast Submission: 2026-06-12T05:48:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "creation-time", "timestamp": "1785117587", "to_ids": false, "type": "datetime", "uuid": "92f5646c-a475-4f78-8bde-fefac6c676a6", "value": "2026-05-19T17:38:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "ssdeep", "timestamp": "1785117587", "to_ids": true, "type": "ssdeep", "uuid": "a71c1d7d-0d84-4254-ba82-40dfdc31c0a8", "value": "24576:8hyAE7NG1VYp7w1Qm6KaJb6ng/B6JhiPxRHYPfM7iAL7KU:UjE7wh2mbamKxRHYPU7iALe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117587", "to_ids": false, "type": "size-in-bytes", "uuid": "dd13e8d6-9427-4bfe-bc4e-eedf1145461c", "value": "1437184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "vhash", "timestamp": "1785117587", "to_ids": true, "type": "vhash", "uuid": "564cb6fe-361a-451b-a749-ea77847d6e87", "value": "1160667d15555d055az69pz3cz1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T16:54:28+00:00", "last_seen": "2026-06-12T05:48:56+00:00", "object_relation": "filename", "timestamp": "1785117587", "to_ids": true, "type": "filename", "uuid": "b91bb2c8-b881-47f8-a6d7-a9c05c5796cc", "value": "33a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87d.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120795", "uuid": "0828c943-4dd8-45d1-b9bc-3360c84a97e6", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "md5", "timestamp": "1785120795", "to_ids": true, "type": "md5", "uuid": "fa462b11-f0b2-4b4d-810f-45fcd0a82428", "value": "8ea54a900bd13ff3ecca01e62428e508", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "sha1", "timestamp": "1785118328", "to_ids": true, "type": "sha1", "uuid": "6e6ec2d2-b658-4ea8-a77c-e64d08aaebdd", "value": "3a0257f31f8db0bf5e1526f4c65f79808e4a5eea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "sha256", "timestamp": "1785118329", "to_ids": true, "type": "sha256", "uuid": "b16adc09-05b8-4980-b166-5a583818f691", "value": "5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "text", "timestamp": "1785117608", "to_ids": false, "type": "text", "uuid": "f51a6428-3c9d-4dcd-b458-fcd8c1375d1c", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/Zusy!MTB\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2026-04-28T10:29:08+00:00\nLast Submission: 2026-05-14T00:45:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "creation-time", "timestamp": "1785117608", "to_ids": false, "type": "datetime", "uuid": "ff77d1e0-7b24-4df9-98f6-bfec4f7306de", "value": "2026-04-27T20:11:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "ssdeep", "timestamp": "1785117608", "to_ids": true, "type": "ssdeep", "uuid": "7b4041dc-4ddd-4e01-a8b5-e7a3b5186fef", "value": "49152:DPZl7peO03NvTEh5/wWT8qpQ/fnlJLRjmjSKsj1WPqXAQrNu:DjIC18nlJoSKsj1WqM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117608", "to_ids": false, "type": "size-in-bytes", "uuid": "77ddf4d7-c534-4bdb-add9-5d552152b074", "value": "4012032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "vhash", "timestamp": "1785117608", "to_ids": true, "type": "vhash", "uuid": "19c73e47-6b79-4e9e-8a5a-51a439b971da", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:29:08+00:00", "last_seen": "2026-05-14T00:45:00+00:00", "object_relation": "filename", "timestamp": "1785117608", "to_ids": true, "type": "filename", "uuid": "4eb3aa3b-4900-47fd-9b9e-1a3d5c26ef0f", "value": "5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120816", "uuid": "9c9540a7-f6a9-4572-8115-d6f1435d7afa", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "md5", "timestamp": "1785120816", "to_ids": true, "type": "md5", "uuid": "03abf151-8b2e-4a15-a577-4cf41c114b85", "value": "578f2dced6d0694a635fe0512acb865a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "sha1", "timestamp": "1785118330", "to_ids": true, "type": "sha1", "uuid": "3d7c9006-30b0-4a4b-8ad0-b4a87123eb07", "value": "25abbf642fdd5f8672b799c3fed56cf433b1c4c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "sha256", "timestamp": "1785118330", "to_ids": true, "type": "sha256", "uuid": "377cc345-e753-41b6-9ce6-1b468f9b9ddb", "value": "652346c05123b4c9556c27f5c5efc4bcd941dd66957e3797c6751246a2bff9c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "text", "timestamp": "1785117630", "to_ids": false, "type": "text", "uuid": "d4b0d23c-af6a-40f6-b426-fe2b1f9df71b", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 33/74\nFirst Seen In The Wild: 2026-05-13T10:11:38+00:00\nFirst Submission: 2026-05-12T17:08:51+00:00\nLast Submission: 2026-05-12T17:08:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "creation-time", "timestamp": "1785117630", "to_ids": false, "type": "datetime", "uuid": "54e499fb-5a9c-4bd2-b02d-a3394dc11329", "value": "2021-02-10T20:37:12+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "ssdeep", "timestamp": "1785117630", "to_ids": true, "type": "ssdeep", "uuid": "e0b8655d-7734-428f-b46e-7dd04bc99422", "value": "24576:Q13aOWrKyPojLIqb761qg7rF4krdcaOXEe4dvMkO7vAz2gcqugg:kaOsPojLIqf61q8rF4krdcaU8Mayk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117630", "to_ids": false, "type": "size-in-bytes", "uuid": "efe39bbe-1664-47bf-b6e3-3b58dc38cb90", "value": "2231808" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "vhash", "timestamp": "1785117630", "to_ids": true, "type": "vhash", "uuid": "f0fedfdf-96b5-41c4-bd9d-44024e3d93ba", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T17:08:51+00:00", "last_seen": "2026-05-12T17:08:51+00:00", "object_relation": "filename", "timestamp": "1785117630", "to_ids": true, "type": "filename", "uuid": "870d898b-6317-4ed1-8c3a-d57b639327c6", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120838", "uuid": "3e371f75-dd98-44a7-b81f-2aa0e044b900", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "md5", "timestamp": "1785120838", "to_ids": true, "type": "md5", "uuid": "a058abb9-accd-462f-852b-5630b74d0091", "value": "bd690ca4daf965ba8f84b5a27d6ef69b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "sha1", "timestamp": "1785118331", "to_ids": true, "type": "sha1", "uuid": "30b848c0-8bfc-4c95-a633-09aadfaff9f0", "value": "b95c3203aad220c6ba5bfb98f9be9353be6dafc2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "sha256", "timestamp": "1785118331", "to_ids": true, "type": "sha256", "uuid": "af0ae78d-1b52-4344-a03e-b5a9f8093b9d", "value": "6adf68448b8541e3cbe4a471845cb6c2ac07613f08698567e5ed76dc2a921834", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "text", "timestamp": "1785117651", "to_ids": false, "type": "text", "uuid": "06a550b4-5e2d-41ea-923d-66201c611423", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-05-21T09:04:09+00:00\nFirst Submission: 2026-05-21T20:09:39+00:00\nLast Submission: 2026-05-21T20:09:39+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "creation-time", "timestamp": "1785117652", "to_ids": false, "type": "datetime", "uuid": "53d50ef1-011c-452e-b25b-7b51d72d8073", "value": "2026-05-21T05:37:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "ssdeep", "timestamp": "1785117651", "to_ids": true, "type": "ssdeep", "uuid": "b64863e3-4dd2-4bc9-b996-dff768d481a0", "value": "49152:YBO2e+8GcD4lFxeNZLoBewXvAva8L2z+971LKYIAaVp8UEy:EdDUL0hIZL2Y1LKYIAt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117651", "to_ids": false, "type": "size-in-bytes", "uuid": "2e9e1bd1-45e7-4fab-a4b6-5c5e93ec5838", "value": "3528704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "vhash", "timestamp": "1785117651", "to_ids": true, "type": "vhash", "uuid": "6309fce8-7c58-4400-8896-dca5ac25b5ba", "value": "1360b76d1555655c051d514z409007c790fjzd3z7226z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-21T20:09:39+00:00", "last_seen": "2026-05-21T20:09:39+00:00", "object_relation": "filename", "timestamp": "1785117651", "to_ids": true, "type": "filename", "uuid": "b307a334-ff57-4d06-8996-bc08d081d67a", "value": "oespy2yl9.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120859", "uuid": "1671f77a-9d1c-484e-8e22-eb5b6add4f5f", "Attribute": [ { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "md5", "timestamp": "1785120859", "to_ids": true, "type": "md5", "uuid": "39e591bc-1b61-4190-a403-ba13940471a6", "value": "9c1b8ffdd27b9f38524155adbdc83000", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "sha1", "timestamp": "1785118332", "to_ids": true, "type": "sha1", "uuid": "264c42e4-120d-4553-86dd-96f107a4920f", "value": "ef44d9a4f2cde724c6d3e8df50c9a8f46692916b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChromEggscalator", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "sha256", "timestamp": "1785118333", "to_ids": true, "type": "sha256", "uuid": "9efd335f-fbb4-42c7-9e36-6cbfdddfb922", "value": "7ee371ff1a13a3bbd26c925a9beedb1aa0d0c03fe6f63d3803a3a55aaccd0a5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "text", "timestamp": "1785117673", "to_ids": false, "type": "text", "uuid": "94e1cc47-0f6b-4545-90ad-7f254080f649", "value": "ChromEggscalator\r\nType Description: Win32 DLL\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-05-03T14:24:46+00:00\nLast Submission: 2026-05-03T14:24:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "creation-time", "timestamp": "1785117673", "to_ids": false, "type": "datetime", "uuid": "c73fe8a5-615e-42a5-9fc6-d2f7f4a529a8", "value": "2026-03-31T12:48:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "ssdeep", "timestamp": "1785117673", "to_ids": true, "type": "ssdeep", "uuid": "6b9ed7cb-7623-487b-8dcf-56f066f56ef6", "value": "768:mXOLu7x0Pncn3l/R7g2Ph+jomlKgyr6upp:q0Pc3v7RPDmlKdv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117673", "to_ids": false, "type": "size-in-bytes", "uuid": "a684098c-383c-485a-8d4a-7a4097929eba", "value": "31431" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "vhash", "timestamp": "1785117673", "to_ids": true, "type": "vhash", "uuid": "cd0d2ee6-ac92-4ada-9f11-8eab8bbefa51", "value": "1340667d05050d05|z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-03T14:24:46+00:00", "last_seen": "2026-05-03T14:24:46+00:00", "object_relation": "filename", "timestamp": "1785117673", "to_ids": true, "type": "filename", "uuid": "dc31334d-5eb9-47d5-a86d-8aa847aeb517", "value": "rex8ldfxa.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120880", "uuid": "85ef2f58-8c20-4bfd-9ee8-ccafbb04ea37", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "md5", "timestamp": "1785120880", "to_ids": true, "type": "md5", "uuid": "1bb7da81-632b-47e3-b6a8-8c5b15e5ba55", "value": "ab7ad8ab31fd6eccda2782c4a1e8b34d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "sha1", "timestamp": "1785118334", "to_ids": true, "type": "sha1", "uuid": "71c4e53a-3e48-4803-b78c-d9ca7b0ba40b", "value": "9c06b1c92b4ad586ff2c0de3809f91b27f9dfd07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "sha256", "timestamp": "1785118334", "to_ids": true, "type": "sha256", "uuid": "b83f8f19-6685-4af2-af00-3549c9232949", "value": "a3a0aced0f3c13b0b9890ec74802a1cb4936bccfaf5e8a6a52f555c82e09d92f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "text", "timestamp": "1785117695", "to_ids": false, "type": "text", "uuid": "ff432d36-d763-4da9-b065-6a4cda3b93e1", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 39/74\nFirst Submission: 2026-05-12T01:12:54+00:00\nLast Submission: 2026-05-12T01:12:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "creation-time", "timestamp": "1785117695", "to_ids": false, "type": "datetime", "uuid": "aa1f41b3-5926-4e8a-92b8-88779c99a6dd", "value": "2026-05-11T08:43:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "ssdeep", "timestamp": "1785117695", "to_ids": true, "type": "ssdeep", "uuid": "c8c52121-7323-40bc-b05c-733e00affe20", "value": "49152:C3N5speO03NvTEh5/wWT8qpQ/fnluLJjmeSKsj1WPMXYQrNl:C8IC18nluJSKsj1WA7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117695", "to_ids": false, "type": "size-in-bytes", "uuid": "b2c16186-2514-4e0c-81f5-de50c4567600", "value": "4012032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "vhash", "timestamp": "1785117695", "to_ids": true, "type": "vhash", "uuid": "c64d4ab0-b436-44cb-87de-ef012b348ac0", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T01:12:54+00:00", "last_seen": "2026-05-12T01:12:54+00:00", "object_relation": "filename", "timestamp": "1785117695", "to_ids": true, "type": "filename", "uuid": "574c6940-a006-45d5-8476-3cdf5bcf25b5", "value": "mf9i1.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120902", "uuid": "980df4a6-b8b2-4005-baa1-b12ddbaf08c0", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "md5", "timestamp": "1785120902", "to_ids": true, "type": "md5", "uuid": "006f25ac-b286-408e-b07c-0a11a6155e11", "value": "3418b6439309250feb2cd983aa00da44", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "sha1", "timestamp": "1785118335", "to_ids": true, "type": "sha1", "uuid": "b812d43a-1a19-4837-b954-e1419cc9be15", "value": "b5b0993b33d65f14a357b4f371d2093238c0e9d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "sha256", "timestamp": "1785118335", "to_ids": true, "type": "sha256", "uuid": "522a395d-ba1d-4872-8ea4-d8d672b96a20", "value": "be7b80f42b0d859b7afaeefca04e46dc10fb5c0a532692bbbfef2924254d1175", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "text", "timestamp": "1785117716", "to_ids": false, "type": "text", "uuid": "2a0ac3d7-4fe8-49ba-9064-378fc95b8a86", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2026-05-27T21:01:21+00:00\nFirst Submission: 2026-05-25T15:23:43+00:00\nLast Submission: 2026-05-27T20:16:04+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "creation-time", "timestamp": "1785117716", "to_ids": false, "type": "datetime", "uuid": "89dafd88-e51c-45e3-b145-187b7fba344c", "value": "2026-05-25T09:12:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "ssdeep", "timestamp": "1785117716", "to_ids": true, "type": "ssdeep", "uuid": "9644983a-328f-4658-be65-618400fd5109", "value": "49152:+tttISsJnkBKncyWKP3PnDGsd0v597fsd2FEVvX5/qrIf:dSUGCVXvdw59jFEVvX5y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117716", "to_ids": false, "type": "size-in-bytes", "uuid": "45646e0b-1299-4587-862e-46d64827228d", "value": "3502080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "vhash", "timestamp": "1785117716", "to_ids": true, "type": "vhash", "uuid": "6922c35b-0e98-4497-9db2-3414e0a696a9", "value": "1360b76d1555655c051d514z409006b710fjzd3z7226z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T15:23:43+00:00", "last_seen": "2026-05-27T20:16:04+00:00", "object_relation": "filename", "timestamp": "1785117716", "to_ids": true, "type": "filename", "uuid": "4c10234b-6ec0-4648-b2ef-d557c64e33e3", "value": "mscomctl.ocx" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120923", "uuid": "01daea5d-8530-4bf0-ac1b-c4fa8beee9cb", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "md5", "timestamp": "1785120923", "to_ids": true, "type": "md5", "uuid": "025e3dd1-ecbd-4952-9acb-198a5d6dd002", "value": "3baa4bcf82f614de9b60b8ad0f76c3ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "sha1", "timestamp": "1785118335", "to_ids": true, "type": "sha1", "uuid": "2b35acac-183c-4743-91fd-398c9a19e142", "value": "b097a11652300552f19c8bf4203a958c2ec47aab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "sha256", "timestamp": "1785118336", "to_ids": true, "type": "sha256", "uuid": "97b5ae9b-a773-422a-b35e-ff8aa0668aff", "value": "c455c02ca6b3844027e05d941830de97753c3966dd57c5fa9f1938d8cd1cca3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "text", "timestamp": "1785117738", "to_ids": false, "type": "text", "uuid": "353a246f-511d-4641-9b1c-fb27939e94e7", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-04-30T07:15:51+00:00\nLast Submission: 2026-05-01T18:25:16+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "creation-time", "timestamp": "1785117738", "to_ids": false, "type": "datetime", "uuid": "8a95138f-8d7f-41fd-8c01-d878dc6bacbe", "value": "2023-04-22T11:39:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "ssdeep", "timestamp": "1785117738", "to_ids": true, "type": "ssdeep", "uuid": "9e27c7ca-c40f-4548-8161-7d6eb3c06535", "value": "24576:6x3aOWrKyPojLRqba5Cyx3rF4/rUsdXp3+FO8O7v2y5HnNotg8:6haOsPojLRqm5CydrF4/rUsd4AMcH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117738", "to_ids": false, "type": "size-in-bytes", "uuid": "e8b16cfd-7026-4286-ac6c-1cd6b3efb9db", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "vhash", "timestamp": "1785117738", "to_ids": true, "type": "vhash", "uuid": "7ef8cc7d-b8f8-47c2-a487-45843776b74e", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T07:15:51+00:00", "last_seen": "2026-05-01T18:25:16+00:00", "object_relation": "filename", "timestamp": "1785117738", "to_ids": true, "type": "filename", "uuid": "b5842c0d-0bbd-44b6-8ab8-c002b8ada285", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120944", "uuid": "6a6642f0-1514-40ee-bde6-bf54ea1a861c", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "md5", "timestamp": "1785120944", "to_ids": true, "type": "md5", "uuid": "94c23d62-dd42-45df-bb44-02a732381d85", "value": "552d991cccd6c5053dfda46c0ac32623", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "sha1", "timestamp": "1785118336", "to_ids": true, "type": "sha1", "uuid": "00e50fbf-d03c-456b-83ec-b0f22ee5c1cb", "value": "7df85059c75bcd3e6280b4c60e1d75c094429664", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "sha256", "timestamp": "1785118336", "to_ids": true, "type": "sha256", "uuid": "8d5c6e76-894d-46e4-b8b6-8776ec1951f9", "value": "c4e2af286ee2ed12375bb66a5bff1a9d3bb5a6579842bc3a28ac00dfae195adc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "text", "timestamp": "1785117759", "to_ids": false, "type": "text", "uuid": "2c10574a-e97e-41b8-a64b-c6bbd8ca893d", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-05-07T10:11:38+00:00\nFirst Submission: 2026-05-06T07:57:23+00:00\nLast Submission: 2026-05-06T07:57:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "creation-time", "timestamp": "1785117759", "to_ids": false, "type": "datetime", "uuid": "06b0bad5-d92f-4d31-95f3-c9c767177f87", "value": "2026-05-04T11:03:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "ssdeep", "timestamp": "1785117759", "to_ids": true, "type": "ssdeep", "uuid": "e4b8b33a-8b99-40b2-bb12-b613e3ccfc1c", "value": "49152:UpNZqpeO03NvTEh5/wWT8qpQ/fnlsyBm5SKsj1WPcXUQ8N1:UwIC18nlKSKsj1Wbb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117759", "to_ids": false, "type": "size-in-bytes", "uuid": "be8ec1a5-cb1b-46d4-9aad-61da24d9647e", "value": "4012032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "vhash", "timestamp": "1785117759", "to_ids": true, "type": "vhash", "uuid": "5459a292-f074-4e55-84f0-d16c97cdd49e", "value": "1460b76d1555655c051d514z409006b730fjzd3z7236z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-06T07:57:23+00:00", "last_seen": "2026-05-06T07:57:23+00:00", "object_relation": "filename", "timestamp": "1785117759", "to_ids": true, "type": "filename", "uuid": "678f3b56-1435-477d-82b1-15b31784d72b", "value": "jvx6g0.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120966", "uuid": "7636e882-9cf7-4aa2-97c0-5a20f6df6f20", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "md5", "timestamp": "1785120966", "to_ids": true, "type": "md5", "uuid": "b3845ad1-4265-4035-b933-ed781855e198", "value": "cbe0daeec71e47840672d930e112d467", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "sha1", "timestamp": "1785118338", "to_ids": true, "type": "sha1", "uuid": "53c8ab3b-e18c-4197-8834-88f30082bba4", "value": "e6b4511b53ed8ef7c857c236a5907d077862f7ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "sha256", "timestamp": "1785118338", "to_ids": true, "type": "sha256", "uuid": "2e43b898-46d4-45c9-a4af-f3cc56e84338", "value": "c4e55e9e6837de01f0dadc7db299abd48630bf115a442f09ea0c6a593c559e6f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "text", "timestamp": "1785117780", "to_ids": false, "type": "text", "uuid": "867d03bd-4ebc-4c97-91db-aeccd4a0079e", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2026-05-21T18:00:57+00:00\nFirst Submission: 2026-05-21T17:37:26+00:00\nLast Submission: 2026-05-21T18:23:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "creation-time", "timestamp": "1785117781", "to_ids": false, "type": "datetime", "uuid": "8e3fabaa-4461-4097-be43-6b56d3c1b6fa", "value": "2026-05-20T11:07:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "ssdeep", "timestamp": "1785117780", "to_ids": true, "type": "ssdeep", "uuid": "211b28ee-e0a0-4568-9368-dd2f16453ea5", "value": "49152:rqxnq+8GcD4lFxeNZLoBewXvAva8L2xX971LKYIAaZ4Uay:kdDUL0hIZL2X1LKYIAJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117780", "to_ids": false, "type": "size-in-bytes", "uuid": "4b33894e-cccb-4a0c-aed5-50008ffd625a", "value": "3528704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "vhash", "timestamp": "1785117780", "to_ids": true, "type": "vhash", "uuid": "179dfaf9-c507-43dc-b4d1-d02ef51385ce", "value": "1360b76d1555655c051d514z409007c790fjzd3z7226z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-21T17:37:26+00:00", "last_seen": "2026-05-21T18:23:18+00:00", "object_relation": "filename", "timestamp": "1785117780", "to_ids": true, "type": "filename", "uuid": "f9824a66-d12b-4ffb-b39d-9acf589b9406", "value": "mscomctl.ocx" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120987", "uuid": "a87022ff-3f96-4be1-a85d-ceb315f3e9f1", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "md5", "timestamp": "1785120987", "to_ids": true, "type": "md5", "uuid": "41c59b9f-eca9-48e6-a9a2-3ac0b4f94ade", "value": "261095b10c38e38ee40c7eed64a70c72", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "sha1", "timestamp": "1785118338", "to_ids": true, "type": "sha1", "uuid": "48211007-86f7-491a-8c9e-6fc9a2685cc4", "value": "d7c6d1356fba6035d9261c5e4523be2c390a8b54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "sha256", "timestamp": "1785118339", "to_ids": true, "type": "sha256", "uuid": "29680754-9957-428c-8e35-cf0b7f8432b0", "value": "ccb6be9211b3946d290e8b23497b8f0e6ac045d1dcde4aaae424680e9029e4eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "text", "timestamp": "1785117803", "to_ids": false, "type": "text", "uuid": "bfc0162c-28d8-4aac-b3c1-2ade3b04fe8b", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2026-05-13T18:11:03+00:00\nLast Submission: 2026-05-13T18:11:03+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "creation-time", "timestamp": "1785117803", "to_ids": false, "type": "datetime", "uuid": "1b06988d-39c5-4a17-bde3-063b36f7fe73", "value": "2022-02-23T23:28:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "ssdeep", "timestamp": "1785117803", "to_ids": true, "type": "ssdeep", "uuid": "9788d7b5-8866-40da-afeb-3212bc45f6bf", "value": "24576:g3aOWrKyPojLCqbeE4C2N8ib1ov79YlJudxhlOrfdGYY2FQW:gaOsPojLCqaE4C2Ndb1ov79YgD6R" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117803", "to_ids": false, "type": "size-in-bytes", "uuid": "47d0f2e9-0504-4104-bb9b-9c1efc75448a", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "vhash", "timestamp": "1785117803", "to_ids": true, "type": "vhash", "uuid": "775644ba-b86c-48e9-ade6-54b683cb2791", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T18:11:03+00:00", "last_seen": "2026-05-13T18:11:03+00:00", "object_relation": "filename", "timestamp": "1785117803", "to_ids": true, "type": "filename", "uuid": "2529b1a1-7020-4ddb-ae36-869c36a9c257", "value": "MSCOMCTL.OCX" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121008", "uuid": "29f7dbbc-98cd-417e-840b-640cf90d867e", "Attribute": [ { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "md5", "timestamp": "1785121008", "to_ids": true, "type": "md5", "uuid": "d649f71c-ef0b-4593-80e2-b4bcb64346da", "value": "9bd6f7a308418a2b376e731d9e80bac1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "sha1", "timestamp": "1785118340", "to_ids": true, "type": "sha1", "uuid": "949f0d9d-1b79-4498-8394-693c52dc5c17", "value": "26545d3db9802c44145e289b8e989d0a68bf90cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ChonkyChicken", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "sha256", "timestamp": "1785118340", "to_ids": true, "type": "sha256", "uuid": "cb3ac3bc-f4ee-469a-930c-eade9a94253c", "value": "e481d16e51f90c4cc0e7096284b53eef06f7ee8b37a03d92734521d8bca24409", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "text", "timestamp": "1785117824", "to_ids": false, "type": "text", "uuid": "29668d23-f490-4938-bc7f-d1211272258a", "value": "ChonkyChicken\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2026-06-10T16:01:27+00:00\nFirst Submission: 2026-06-10T16:04:47+00:00\nLast Submission: 2026-06-10T21:30:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "creation-time", "timestamp": "1785117824", "to_ids": false, "type": "datetime", "uuid": "9f081954-8a7b-42fb-b942-bda266642e6f", "value": "2026-06-01T05:57:05+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "ssdeep", "timestamp": "1785117824", "to_ids": true, "type": "ssdeep", "uuid": "0b724525-eaff-4606-b4d3-c75b93d4320c", "value": "49152:EZtsISsJnkBKncyWKP3PnDGsd0v59YFBd2FEVvX5/1kI+e:uSUGCVXvdw59fFEVvX59B" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117824", "to_ids": false, "type": "size-in-bytes", "uuid": "1f7242e7-ff3a-425f-97a1-13781e0ec0dc", "value": "3502080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "vhash", "timestamp": "1785117824", "to_ids": true, "type": "vhash", "uuid": "18d22f6f-195c-46bd-836c-51b8545a84e1", "value": "1360b76d1555655c051d514z409006b710fjzd3z7226z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T16:04:47+00:00", "last_seen": "2026-06-10T21:30:42+00:00", "object_relation": "filename", "timestamp": "1785117824", "to_ids": true, "type": "filename", "uuid": "8f01c6be-90e2-43fc-a062-24e60e063a53", "value": "rbqtox.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121029", "uuid": "3a840ee2-34cc-40dc-8756-988dcbf85d27", "Attribute": [ { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "md5", "timestamp": "1785121029", "to_ids": true, "type": "md5", "uuid": "3c5289c2-9182-4272-b198-4d5dbd1fb7cd", "value": "2b8e8b5ab0b12445b606b6e6fb3b41bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "sha1", "timestamp": "1785118341", "to_ids": true, "type": "sha1", "uuid": "fc741718-d734-4976-8fff-d668cdf467c7", "value": "0beeb270406589cefc8ab730072de80e0f1c808b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TinyEgg", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "sha256", "timestamp": "1785118341", "to_ids": true, "type": "sha256", "uuid": "eaad0ef9-e8b5-49ce-bc18-9578e20fb36f", "value": "f3f4de7eb30c01044ad3c7f2c22376d0ab6f6dc60ef6aee3cde75fd33fbddacc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "text", "timestamp": "1785117866", "to_ids": false, "type": "text", "uuid": "f9c487c4-6caf-4c25-a195-c17c46275059", "value": "TinyEgg\r\nType Description: Win32 DLL\nOriginal name: MSCOMCTL.OCX\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2026-04-29T21:15:25+00:00\nLast Submission: 2026-04-29T21:15:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "creation-time", "timestamp": "1785117867", "to_ids": false, "type": "datetime", "uuid": "363c2827-94cb-46eb-8224-ed8e9853c432", "value": "2020-03-20T13:33:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "ssdeep", "timestamp": "1785117866", "to_ids": true, "type": "ssdeep", "uuid": "a9e25d8e-ddc5-4330-be62-e881c4319cc0", "value": "24576:oO3aOWrKyPojL4qb25wYRC21oUKqC0zX8KoadOEfWB2PQWQ7rofvQl:taOsPojL4qa5wYA21oUKqC0hTkol9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117866", "to_ids": false, "type": "size-in-bytes", "uuid": "800f9cc3-b4f9-42fc-8bf6-9b664fa9b2dc", "value": "2231296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "vhash", "timestamp": "1785117866", "to_ids": true, "type": "vhash", "uuid": "51d65cd2-cf69-4e09-9fb0-24ba6d063ee8", "value": "1260c76d1555655c051d1013z42z3c57sz1d6z5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T21:15:25+00:00", "last_seen": "2026-04-29T21:15:25+00:00", "object_relation": "filename", "timestamp": "1785117866", "to_ids": true, "type": "filename", "uuid": "d3b3cf8e-8cb6-4495-ae58-5bed477d6c1f", "value": "MSCOMCTL.OCX" } ] } ] } }