{ "Event": { "analysis": "1", "date": "2026-06-24", "extends_uuid": "", "info": "[Threat Intel] New Backdoor May be Linked to Ransomware Access Broker", "protected": false, "publish_timestamp": "1782459184", "published": true, "threat_level_id": "2", "timestamp": "1782459184", "uuid": "f0e4eb83-f296-466d-8e0d-5f5ca15a8e44", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#892644", "local": false, "name": "misp-galaxy:producer=\"Symantec\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#aff0ae", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#f9fe8d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Kerberoasting - T1558.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"KongTuke\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Qilin\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Qilin\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782356407", "to_ids": false, "type": "link", "uuid": "2b280bf6-4e1d-4e07-861f-b3a7e4964368", "value": "https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782356407", "to_ids": false, "type": "text", "uuid": "0375f354-42d7-485d-a85f-b526a6a3d0fe", "value": "A stealthy new backdoor called Mistic has been deployed in cybercrime intrusions since April 2026, potentially linked to Woodgnat, an initial access broker associated with multiple ransomware operations including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta. Mistic was deployed alongside ModeloRAT in at least one case, a tool developed by Woodgnat. The backdoor uses sideloading techniques through legitimate Microsoft files and executes payloads in memory without writing to disk. It includes typical backdoor capabilities plus a self-delete kill switch for enhanced stealth. Targeting appears opportunistic across insurance, education, IT and professional services sectors. Woodgnat operates as an IAB, establishing durable remote access within enterprises and selling this access to ransomware affiliates, using various social-engineering techniques including ClickFix, FileFix and CrashFix lures delivered through compromised WordPress sites." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782356407", "to_ids": false, "type": "text", "uuid": "6f64e6f4-dcfe-421c-b0e1-20b8a99b16fe", "value": "Name: New Backdoor May be Linked to Ransomware Access Broker\nAuthor: AlienVault\nAdversary: Woodgnat\nTags: [\"initial access broker\", \"sideloading\", \"social-engineering\", \"nexshield\", \"credential stealer\", \"qilin\", \"d3f@ck loader\", \"ransomware\", \"mintsloader\", \"gatekeeper\", \"backdoor.mistic\", \"modelorat\"]\nTgtd countries: []\nMlwr families: [\"Backdoor.Mistic\", \"ModeloRAT\", \"GateKeeper\", \"NexShield\", \"MintsLoader\", \"D3F@ck Loader\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1069\", \"T1082\", \"T1140\", \"T1555\", \"T1055\", \"T1112\", \"T1087\", \"T1083\", \"T1057\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1071.001\", \"T1018\", \"T1574.002\", \"T1105\", \"T1558.003\"]\nIndustries: [\"Insurance\", \"Education\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1782356407", "to_ids": false, "type": "threat-actor", "uuid": "d39055c3-983f-4f9a-b907-d3f3d289d320", "value": "Woodgnat" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456240", "to_ids": true, "type": "hostname", "uuid": "279aff88-ec40-4536-8bda-dd6d757299d3", "value": "mail.authorized-logins.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456261", "to_ids": true, "type": "domain", "uuid": "d6fde6ae-8086-45c5-b7d8-56954ee4d14c", "value": "mueleer.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456282", "to_ids": true, "type": "domain", "uuid": "98959295-bb6b-4301-a7c3-6c62ffd1e671", "value": "grande-luna.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456303", "to_ids": true, "type": "domain", "uuid": "3b752195-5910-4a79-af87-ce0d10eb8d32", "value": "oeannon.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456324", "to_ids": true, "type": "domain", "uuid": "2132446d-36c8-43aa-9f21-4ecb310f90bc", "value": "thomphon.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456345", "to_ids": true, "type": "domain", "uuid": "f6e09edf-fbd0-460c-a220-1846bc23967f", "value": "human-check.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456366", "to_ids": true, "type": "hostname", "uuid": "4ff4b0b5-ede1-4781-9666-8e800613a09b", "value": "update.update-fall.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456387", "to_ids": true, "type": "domain", "uuid": "b1857387-1cee-487d-b673-5e5655f059ef", "value": "cwrtwright.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456408", "to_ids": true, "type": "domain", "uuid": "3352d697-6034-4c4c-aedc-858703330afe", "value": "carrolc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456429", "to_ids": true, "type": "domain", "uuid": "f3107faf-9e89-462c-8c2f-e1f563d0df03", "value": "w3xasv14culvnqj.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456450", "to_ids": true, "type": "ip-dst", "uuid": "b6e580f8-c65f-4ab2-a08a-23c83029a0fc", "value": "144.31.53.78", "Tag": [ { "colour": "#917280", "local": false, "name": "asn:asn=\"401152\"", "relationship_type": "" }, { "colour": "#fcf58e", "local": false, "name": "asn:as-owner=\"ADCIL-ASN-01\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456471", "to_ids": true, "type": "ip-dst", "uuid": "ff9b62da-a44d-440e-8535-122a15125391", "value": "198.13.159.44", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456492", "to_ids": true, "type": "ip-dst", "uuid": "43d48992-8a43-46c3-8ccd-e99c344c7f8a", "value": "199.91.221.42", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456513", "to_ids": true, "type": "url", "uuid": "58a050b5-6e17-4c71-b376-e928fa82b186", "value": "http://thomphon.com/update.msi", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456534", "to_ids": true, "type": "domain", "uuid": "fdc3f28c-62ef-46a0-be4c-4ef7cc90ae74", "value": "authorized-logins.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456556", "to_ids": true, "type": "domain", "uuid": "30677488-1719-4f79-af99-33a11b6063f9", "value": "b6w9m2z5x8q1v3k.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456577", "to_ids": true, "type": "domain", "uuid": "eced26dc-66e6-4490-bdb0-17402899c5cd", "value": "rotoa-upda-lo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456599", "to_ids": true, "type": "domain", "uuid": "fed6d12a-f8ff-46ea-bf51-c4ccacbf77d0", "value": "sql-updater-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456619", "to_ids": true, "type": "domain", "uuid": "da2266e1-f21b-4799-a859-5641ef46dd7a", "value": "upd-domain-goloro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456641", "to_ids": true, "type": "domain", "uuid": "76960da8-1fe1-4126-9391-49e689f5bc76", "value": "updater-worelos.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456662", "to_ids": true, "type": "domain", "uuid": "d7177e82-cea5-4638-8fc9-b837ebb5cc08", "value": "upscale-kolo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456683", "to_ids": true, "type": "hostname", "uuid": "10e02db2-3105-478b-a825-a1d09fb57764", "value": "defs.updater-worelos.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456704", "to_ids": true, "type": "hostname", "uuid": "d83fd425-230c-4f12-9140-2058e12f3906", "value": "ftps.upd-domain-goloro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456725", "to_ids": true, "type": "hostname", "uuid": "b91af3ec-39ca-4380-8817-ca7049ccc044", "value": "mailes.upd-domain-goloro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456746", "to_ids": true, "type": "hostname", "uuid": "e217c508-113c-48e5-b89a-835dea9612f3", "value": "mails.updater-worelos.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456767", "to_ids": true, "type": "hostname", "uuid": "f4c39e2b-ee7d-4d48-8a9c-3dfe33a6611b", "value": "nano.upscale-kolo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456788", "to_ids": true, "type": "hostname", "uuid": "9a420db3-409a-4147-834f-f139d2c193b2", "value": "php.authorized-logins.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456809", "to_ids": true, "type": "hostname", "uuid": "8c5cab9b-89c9-4e49-b7ae-6e3710317f49", "value": "sss.authorized-logins.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456830", "to_ids": true, "type": "ip-dst", "uuid": "190fdeab-6470-4d61-a9e7-6bbe562a36eb", "value": "142.93.242.144", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782456851", "to_ids": true, "type": "domain", "uuid": "f8385fa5-513c-49be-bdfb-b7f1062ffb54", "value": "cj06y9v4xab.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782456872", "uuid": "ba2cd8b3-9822-4fbc-8e51-6853ad76df2a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782456872", "to_ids": true, "type": "md5", "uuid": "6acecc0a-0167-4a5c-be07-52d1070b03f8", "value": "dc96668d007df0a545bf1334e10e80fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456033", "to_ids": true, "type": "sha1", "uuid": "363d11f7-5438-4207-b0ac-59816ab323d5", "value": "48d4872e8463d1ede1b93e3f6a6a8cc8c2cecde3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456033", "to_ids": true, "type": "sha256", "uuid": "81ae1624-d5fe-4ae8-a0e3-b75121708ab2", "value": "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454722", "to_ids": true, "type": "ssdeep", "uuid": "acae6e2a-ade1-401a-bb2f-c1218dab6da4", "value": "24576:lvC0dkQlvjqIFfQmvBQLkBV31t452SmN6kbbU2MdXdb3PsXwevwSwmavUrHIA:51xjLFfQnQBN1tLSmNMxdbEAevwnqDIA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454722", "to_ids": false, "type": "size-in-bytes", "uuid": "87070e1e-ae06-404a-9f3d-c0043d2f598b", "value": "1298432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454722", "to_ids": true, "type": "vhash", "uuid": "903f6950-a80d-4bc5-9146-0a6561b739ea", "value": "c0898bab35bfdb4cf79d4dc80efd6624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454722", "to_ids": true, "type": "filename", "uuid": "cd770852-98ff-4ded-bb3e-92c811845f50", "value": "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be.msi" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454722", "to_ids": false, "type": "text", "uuid": "7b433d3a-65f1-4ecc-a609-3a081a07e58b", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: Trojan:Win32/Cobaltstrike!MSR\nVT Total Detection:34/62\nFirst Submission:2026-04-14T23:22:35.000000+00:00\nLast Submission:2026-04-15T00:37:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782456893", "uuid": "25cf5b64-f74e-488b-a09b-ffde756d0bb1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782456893", "to_ids": true, "type": "md5", "uuid": "84d081da-d4b7-4c4f-b18d-b72efa3bd645", "value": "347a3f5f2ed2f503a22f68c4951c78c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456035", "to_ids": true, "type": "sha1", "uuid": "ae6d8ec1-5430-4705-955d-c5dd3e7bf53d", "value": "fd8e880cc32377af08327c9d187f6220c6ac449f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456035", "to_ids": true, "type": "sha256", "uuid": "b75e31c8-e39c-40f2-a53b-fb427b10aa1a", "value": "fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454744", "to_ids": true, "type": "ssdeep", "uuid": "02446d7f-3ef6-4575-b1d4-8a982c3a64d3", "value": "24576:PZmEAFPua6zEDBiqGEpHFSwB3Qnc9PYUqdsc9lY+WZVWgH:P/aAUsp4rg+PYUxcg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454744", "to_ids": false, "type": "size-in-bytes", "uuid": "6c165ae4-c8ef-4602-92cc-d9309cab5cfc", "value": "1490944" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454744", "to_ids": true, "type": "vhash", "uuid": "43e1689a-abda-4608-a356-3d05725904da", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454744", "to_ids": true, "type": "filename", "uuid": "f0554c4a-edcc-4fe3-b164-ea52309a9e3e", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454744", "to_ids": false, "type": "text", "uuid": "1ad4590b-a478-49ac-a51b-0eab5a2adc3f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Havoc.MX!MTB\nVT Total Detection:45/71\nFirst Submission:2026-04-20T13:24:15.000000+00:00\nLast Submission:2026-04-20T14:38:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782456914", "uuid": "fd598ba7-cc69-4a03-b88e-bf9e6f1b7881", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782456914", "to_ids": true, "type": "md5", "uuid": "db4ac39e-775e-4b34-89eb-189b62d08c85", "value": "d36f334560a1f40fe0e1d8b97f8c7b5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456036", "to_ids": true, "type": "sha1", "uuid": "d143c795-0c91-43c3-a51a-80f14670edf0", "value": "8ed835039beae50a135da8536afa794d93158b8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456036", "to_ids": true, "type": "sha256", "uuid": "e787e2a0-6242-42a4-8208-27fd469bba4e", "value": "59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454765", "to_ids": true, "type": "ssdeep", "uuid": "ba56c344-f6e7-438a-a44d-f35ef58d8016", "value": "3072:p2pQt7DcEwKAi9QYw47727KlLJKJKJbcSD9O8ckVPxIiTfinc:sQtvcuNlw47ikdyc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454765", "to_ids": false, "type": "size-in-bytes", "uuid": "4cb3f04f-37f2-463f-af64-f60c5d31defe", "value": "105472" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454765", "to_ids": true, "type": "vhash", "uuid": "35d26a94-389f-41a6-b7f8-1eae14f1ec08", "value": "115066655d155d055058z4c=z11" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454766", "to_ids": true, "type": "filename", "uuid": "d48cea34-30aa-481d-a4f2-6f22190822f4", "value": "VersionDll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454766", "to_ids": false, "type": "text", "uuid": "56deb560-53e8-4123-a6c0-740431ac606e", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:39/71\nFirst Submission:2026-04-10T20:07:40.000000+00:00\nLast Submission:2026-04-24T03:46:33.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782456935", "uuid": "f3c86caf-638f-4971-b51b-8b233be7c6ef", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782456935", "to_ids": true, "type": "md5", "uuid": "7c0f1504-06a6-4d10-b829-a7d8a6c28935", "value": "6b8ec32dc76fa3138f00616156962f4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456038", "to_ids": true, "type": "sha1", "uuid": "07a6dc5a-912a-4e3a-8892-83bfc48b51a5", "value": "deb10789274bf903060d700b3472fdf094a14763", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456038", "to_ids": true, "type": "sha256", "uuid": "c9476895-fdc4-460c-a9cb-ddd9b5616332", "value": "afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454787", "to_ids": true, "type": "ssdeep", "uuid": "9b7cbd39-6e3a-4c05-85b9-7f4a52bce294", "value": "24576:cNzdl3kHK1wimsrF3dwmo1DfPVUjmElHWIRw5QTOJug77:mmK1zHFKmoBVoN5WGp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454787", "to_ids": false, "type": "size-in-bytes", "uuid": "eddb8137-5c3e-4297-863e-df9f1a72c0a2", "value": "1388544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454787", "to_ids": true, "type": "vhash", "uuid": "d30aed70-4bcf-42ae-a606-ef7e63acbd01", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454787", "to_ids": true, "type": "filename", "uuid": "3a829eac-dc75-465a-8ebc-eee1f2bd0fcd", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454787", "to_ids": false, "type": "text", "uuid": "fad01bd5-c200-4a34-9aee-9af871b35fe6", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Cobaltstrike!MSR\nVT Total Detection:43/71\nFirst Submission:2026-04-14T23:23:12.000000+00:00\nLast Submission:2026-04-14T23:23:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782456956", "uuid": "833a0c0b-1291-46cb-ada1-c7cf2dac4cbc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782456956", "to_ids": true, "type": "md5", "uuid": "3d3d8457-3733-43de-b593-7608f6b96575", "value": "b148626849c11dd5b3230632a38a6302", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456039", "to_ids": true, "type": "sha1", "uuid": "db5ad187-81da-4374-b194-6ab54aff6bb9", "value": "e5c4e634b2f443f783cae1b5e8247a1069df0c9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456039", "to_ids": true, "type": "sha256", "uuid": "2bd245b0-5786-4db2-b3b2-c328f37db27a", "value": "1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454809", "to_ids": true, "type": "ssdeep", "uuid": "94c5827c-ef41-4e45-85c3-b92315aa3536", "value": "1536:P0+2AGtCUy8rGThQxoF03RtMpfeRypyt6Yex:P0+2AGtQ8Pxoi2pxpqQx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454809", "to_ids": false, "type": "size-in-bytes", "uuid": "641be4ef-4120-4b9c-b893-5056da6d947f", "value": "54272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454809", "to_ids": true, "type": "vhash", "uuid": "b95f5f17-c88f-4419-b64b-8e46bcfb6688", "value": "154066655d150d051bze?z8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454809", "to_ids": true, "type": "filename", "uuid": "d2ddb4b6-505d-40cd-ad72-e22b6d3d586c", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454809", "to_ids": false, "type": "text", "uuid": "20883991-faa1-4f31-b468-e7a3fa5c3a2b", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:44/71\nFirst Submission:2026-04-24T16:55:01.000000+00:00\nLast Submission:2026-05-01T06:13:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782456978", "uuid": "eb9a6b82-4bf7-4673-a35a-0500a8d258ea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782456978", "to_ids": true, "type": "md5", "uuid": "7cc883c4-b3f9-4220-a5b8-69ce92aa6a1f", "value": "7bc15e8ec688c4ae8a4d942a05cd949d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456040", "to_ids": true, "type": "sha1", "uuid": "6b74c973-0e94-414e-92fb-909d15536285", "value": "271946f87b93801b141363005b48cffc1b083006", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456041", "to_ids": true, "type": "sha256", "uuid": "2bb61c3e-467d-43a7-8209-dcd0ab23c100", "value": "34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454831", "to_ids": true, "type": "ssdeep", "uuid": "2e4fbed3-b4ce-450d-ad10-fd312c74fe12", "value": "24576:LqoNKiCMAdue4z06Qn7GCzN+jcKPmT2ixFPHVaP53SoYZ9:+fME4z0X7GC4QCi7P1I53K9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454831", "to_ids": false, "type": "size-in-bytes", "uuid": "dabb8a6b-b157-4c14-9551-c136148c2614", "value": "1076736" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454831", "to_ids": true, "type": "vhash", "uuid": "fe246788-4b5b-4ca9-bc3a-f865528929b2", "value": "31603675151240821413d013" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454831", "to_ids": true, "type": "filename", "uuid": "1643d3cf-20ef-4f14-82a7-e8d6d2579f18", "value": "Fly.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454831", "to_ids": false, "type": "text", "uuid": "d028238d-8147-405a-86da-0ffdc25dab1e", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:19/71\nFirst Submission:2026-03-09T18:40:55.000000+00:00\nLast Submission:2026-03-09T18:40:55.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457000", "uuid": "5b0fb49c-9d6e-4010-9b40-1ec9ada6fab2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457000", "to_ids": true, "type": "md5", "uuid": "9965388e-1cae-47d2-a670-0fcdde90eb6b", "value": "66850a023c20afae2d16e81d95e55a22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456042", "to_ids": true, "type": "sha1", "uuid": "c8adecc8-0dfa-4eba-badf-20a1318beac0", "value": "e0958dcfe58b34363b4490790c4e492683f7ed9d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456042", "to_ids": true, "type": "sha256", "uuid": "fd326db6-7b6b-4c8b-a900-12d22200ff4d", "value": "8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454852", "to_ids": true, "type": "ssdeep", "uuid": "9cf752bf-9ca3-4606-ba96-959fb45f1f15", "value": "6144:zF9/Y+7edCARGuIL9hLZ2+HgSX0CmkNbISP1KU0cdtFyfIK3/tGV/RVRCgz/Uao:56r5ILtxnDxdtUGV/0Uc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454852", "to_ids": false, "type": "size-in-bytes", "uuid": "42f77873-1d07-444c-8541-0ad256c307cc", "value": "332800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454852", "to_ids": true, "type": "vhash", "uuid": "9f3d0414-aa9d-4dc1-a097-39abe51f0de5", "value": "135056655d1d056az4c?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454852", "to_ids": true, "type": "filename", "uuid": "7849604c-8667-4a08-8a6d-2f439d916118", "value": "g8d34uv.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454852", "to_ids": false, "type": "text", "uuid": "04466b9a-140a-419d-8e4b-aa55ba9bb26b", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:25/71\nFirst Submission:2026-03-09T18:42:10.000000+00:00\nLast Submission:2026-03-09T18:42:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457021", "uuid": "5a615473-9a45-478c-be72-c4e8a96dcb07", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457021", "to_ids": true, "type": "md5", "uuid": "edae9e91-4b25-4a73-a1a4-0cfdf865d3f5", "value": "32cbc4932404ab1c4dae4b3f6b28215d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456043", "to_ids": true, "type": "sha1", "uuid": "636b0f2a-8e89-45a3-8236-600286821394", "value": "41d55b0c37b1dde645751b614fc531906f72e118", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456043", "to_ids": true, "type": "sha256", "uuid": "9b0793e5-b617-419a-b085-66f473d08fdd", "value": "db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454874", "to_ids": true, "type": "ssdeep", "uuid": "a3748597-efdb-487b-8d6e-ef5bca4d7267", "value": "1536:VtY8ZxBJKBfXEc3Vw2EvZfrk2Vf02/2mXloQ+/jh:YaJKu2QZfg2t6mUbh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454874", "to_ids": false, "type": "size-in-bytes", "uuid": "240c010c-05ae-47c7-9197-2bb4a4980ae9", "value": "71680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454874", "to_ids": true, "type": "vhash", "uuid": "0ef36209-a226-4a3a-b62f-6d117ecdf3d4", "value": "174056655d15151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454874", "to_ids": true, "type": "filename", "uuid": "ac71bb20-4af8-43bc-9d43-e14f39a5f934", "value": "EndpointDlp" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454874", "to_ids": false, "type": "text", "uuid": "529a0a5f-22b2-4e8c-abf9-180c2dc5cb10", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:36/71\nFirst Submission:2026-04-10T20:07:39.000000+00:00\nLast Submission:2026-04-10T20:07:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457042", "uuid": "e16335fc-330f-45c3-9af6-3d7a11f766dc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457042", "to_ids": true, "type": "md5", "uuid": "fe1363b0-8f1a-410d-9f88-f3853cc760ac", "value": "11be87f69fe6c951fc985d117405609b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456045", "to_ids": true, "type": "sha1", "uuid": "8890e44a-47d3-4a94-806b-925a7bcb1f76", "value": "dd33e2742f3d8a7a0f7145e68744540b0fffa79f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456045", "to_ids": true, "type": "sha256", "uuid": "e5075703-3aea-48a3-8ce5-e5c8ee7d4d07", "value": "f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782454896", "to_ids": true, "type": "ssdeep", "uuid": "29ea6d98-832f-48fd-af18-1294709d44c6", "value": "12288:+ndompk3YTY9okxxBRZt2Bv/dVS6HGmpmZAX6RN4pO0:QMYTY9rBZ2JDLHFWAXb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782454896", "to_ids": false, "type": "size-in-bytes", "uuid": "875a1084-fdf0-4180-9807-54a883430f12", "value": "512000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782454896", "to_ids": true, "type": "vhash", "uuid": "56adc58e-68ff-409f-944a-8c7e821e8bee", "value": "c0898bab35bfdb4cf79d4dc80efd6624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782454896", "to_ids": true, "type": "filename", "uuid": "0a82ead9-637f-4df3-a414-259c578ee9b6", "value": "update.msi" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782454896", "to_ids": false, "type": "text", "uuid": "0cb85d03-7358-4aa6-8911-441b0b1974c8", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:30/63\nFirst Submission:2026-04-10T20:07:13.000000+00:00\nLast Submission:2026-04-10T20:07:13.000000+00:00" } ] } ] } }