{ "Event": { "analysis": "1", "date": "2026-04-16", "extends_uuid": "", "info": "[Threat Intel] A Deep Dive Into Attempted Exploitation of CVE-2023-33538", "protected": false, "publish_timestamp": "1776767197", "published": true, "threat_level_id": "2", "timestamp": "1776767196", "uuid": "f71a7e8b-e433-4bb8-9646-5fafa3017535", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0afe32", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#9c8729", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#b2a633", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#71ecdb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"", "relationship_type": "" }, { "colour": "#e985c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"ROMMONkit - T1542.004\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#0aebeb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"vulnerability\"", "relationship_type": "" }, { "colour": "#170057", "local": false, "name": "rectifyq:sub-category=\"critical-vuln\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "link", "uuid": "3b5a2456-4097-4df8-a7bf-ab8275b0ea54", "value": "https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/04_Vulnerabilities_1920x900.jpg" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "link", "uuid": "b9c454b2-b0b3-44e0-a0a0-5303a495d902", "value": "https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "text", "uuid": "dbe363e5-b20f-4e36-b59d-f34a9fd2cf04", "value": "Active exploitation attempts targeting CVE-2023-33538 in end-of-life TP-Link Wi-Fi routers were identified after CISA added it to the KEV catalog in June 2025. The vulnerability affects several router models including TL-WR940N, TL-WR740N, and TL-WR841N. Observed attacks attempted to deploy Mirai-like botnet malware, specifically variants associated with the Condi IoT botnet. Through firmware emulation and reverse engineering, researchers confirmed the vulnerability exists but discovered that successful exploitation requires authentication. The in-the-wild attacks contained critical flaws: they targeted the wrong parameter (ssid instead of ssid1), lacked authentication, and relied on utilities not present in the router firmware. The command injection vulnerability in the WlanNetworkRpm endpoint allows remote attackers to execute arbitrary commands when authenticated. The malware establishes C2 communication and propagates across architectures. TP-Link confirmed affected devices are end-of-life with no patc..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "text", "uuid": "af59524b-8af4-4de3-a033-f147274bf6ab", "value": "Name: A Deep Dive Into Attempted Exploitation of CVE-2023-33538\nAuthor: AlienVault\nAdversary: \nTags: [\"cve-2023-33538\", \"tp-link routers\", \"iot exploitation\", \"firmware analysis\", \"condi botnet\", \"command injection\", \"wifi routers\", \"mirai\", \"condi\", \"mirai botnet\"]\nTgtd countries: []\nMlwr families: [\"Mirai\", \"Condi\"]\nAttack_ids: [\"T1543\", \"T1133\", \"T1489\", \"T1082\", \"T1071\", \"T1190\", \"T1059\", \"T1049\", \"T1098\", \"T1542.004\", \"T1059.004\", \"T1078\", \"T1486\", \"T1573\", \"T1203\", \"T1071.001\", \"T1018\", \"T1046\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693273", "to_ids": true, "type": "hostname", "uuid": "11144e91-6bc8-4abd-b4eb-4bf454f69335", "value": "bot.ddosvps.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "51cafaa5-00ce-4f89-9593-c62a33180338", "value": "CVE-2024-3400" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "1df6e099-6673-4ed1-841b-f5d598cc35ca", "value": "CVE-2023-33538" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693294", "to_ids": true, "type": "hostname", "uuid": "d108e7e1-3886-4bdc-86ca-9d4cea62501f", "value": "cnc.vietdediserver.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "fc13235a-12ba-47f5-9c8a-ea7fe852d43e", "value": "CVE-2025-59287" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "33c528a5-ca7a-43d7-a468-d76154b01dce", "value": "CVE-2025-21042" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "2b860e9a-5b1b-458f-b471-71936527ae0f", "value": "CVE-2025-55182" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "97c9349d-00bb-4771-833b-01b25e82d4b1", "value": "CVE-2025-66478" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "4156ab0f-9727-44e0-bf78-7687676e0ede", "value": "CVE-2025-14847" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "a3d53b2f-7f38-4390-bc01-e0595bd77552", "value": "CVE-2026-1281" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "5d39048c-bdd5-4d33-9d3a-09d4ec275eda", "value": "CVE-2026-1340" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "9d74d81e-b8e9-4bbc-aa15-cb8ddba4de7f", "value": "CVE-2026-1731" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "ea11634d-7cff-42b8-bbe9-45ed3417e96e", "value": "CVE-2025-0921" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "6f3bd6b4-4ca8-4fa3-8117-5b0b1deb6137", "value": "CVE-2025-23304" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776423607", "to_ids": false, "type": "vulnerability", "uuid": "2085abb2-d03b-4c9c-bd59-8ece90c69269", "value": "CVE-2026-22584" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693315", "to_ids": true, "type": "url", "uuid": "22e3ad33-93ba-4bfb-a2d6-071239fd5278", "value": "http://bot.ddosvps.cc/top1hbt.arm", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693337", "to_ids": true, "type": "url", "uuid": "ebea3c25-bec5-401f-9663-3ba99b866c26", "value": "http://bot.ddosvps.cc/top1hbt.arm5", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693359", "to_ids": true, "type": "url", "uuid": "e2f98b37-2a83-471b-8cdb-6fa22aacb387", "value": "http://bot.ddosvps.cc/top1hbt.arm6", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693380", "to_ids": true, "type": "url", "uuid": "f625feff-dc12-4a17-8e91-b770033c4f9d", "value": "http://bot.ddosvps.cc/top1hbt.arm7", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693401", "to_ids": true, "type": "url", "uuid": "7913fdaa-1e09-4b5d-9a64-8079f8cf9b15", "value": "http://bot.ddosvps.cc/top1hbt.mips", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693422", "to_ids": true, "type": "url", "uuid": "0f1e83f0-bed6-4574-a44d-88507bf9e60e", "value": "http://bot.ddosvps.cc/top1hbt.mpsl", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693443", "to_ids": true, "type": "url", "uuid": "f244be97-c4be-475c-9487-a5be5788330a", "value": "http://bot.ddosvps.cc/top1hbt.x86_64", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693464", "to_ids": true, "type": "url", "uuid": "fdefb5d7-af58-4b6c-8a1e-865e98d53bc3", "value": "http://bot.ddosvps.cc/top1hbt.sh4", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693485", "to_ids": true, "type": "url", "uuid": "89f775ca-ee15-43fa-80a2-87485aca062e", "value": "http://51.38.137.113/arm", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693507", "to_ids": true, "type": "url", "uuid": "51465022-646d-46ad-b9a8-c4e86f037fe5", "value": "http://51.38.137.113/arm5", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693528", "to_ids": true, "type": "url", "uuid": "0e5b70bf-6f00-47e1-86e7-a32a60ee5e80", "value": "http://51.38.137.113/arm6", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693549", "to_ids": true, "type": "url", "uuid": "51998ae7-b2ee-4cd5-bb25-d1f7cc3e770d", "value": "http://51.38.137.113/arm7", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693570", "to_ids": true, "type": "url", "uuid": "4fc25139-97ec-4a69-9b29-0e06cd368984", "value": "http://51.38.137.113/x86_64", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693592", "to_ids": true, "type": "url", "uuid": "8503abb9-1bac-4e6f-bb1d-dbf11047b4e9", "value": "http://51.38.137.113/mips", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693613", "to_ids": true, "type": "url", "uuid": "a1a68c7c-aa4e-4a41-ba09-82f777f69b1f", "value": "http://51.38.137.113/sh4", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1776693634", "to_ids": true, "type": "ip-dst", "uuid": "177b71e4-0f2b-47fa-b527-6197ee8049a4", "value": "51.38.137.113", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693655", "uuid": "da4f65db-423b-4f1e-bc56-e65397970106", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693655", "to_ids": true, "type": "md5", "uuid": "af4cdc3c-bd22-4cfc-91a7-ff40c0d1c126", "value": "1e9b64497633d470a8294eb574ae0ada", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692027", "to_ids": true, "type": "sha1", "uuid": "90bad157-6760-41d8-9699-4188ff43fdf4", "value": "466ea2205a239b937decfa8ed230cc87e1c26143", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692027", "to_ids": true, "type": "sha256", "uuid": "4e806e2f-bb1c-46f6-9fc4-8a477c8464b0", "value": "919f292a07a37f163f88527e725406187c8ecc637387ad24853fe49ce4e6ddf4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689398", "to_ids": true, "type": "ssdeep", "uuid": "8f9818fa-ed2b-48a5-b23e-8d923ac2b931", "value": "1536:2aVTHW/qIAmHqwtHFGEWCRsKxKlnL7lvyiHzYNWtEPxu8AD/z7:2qWLKwtlDWMzxOVvyOsWKPx4Db7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689398", "to_ids": false, "type": "size-in-bytes", "uuid": "c71c46d0-e40d-44a5-bd33-1622f5a9245f", "value": "117568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689398", "to_ids": true, "type": "vhash", "uuid": "ee8af7ff-f5a7-4072-92c7-70a044bd0694", "value": "92533318fb6f0365eefd25090e7df146" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689398", "to_ids": true, "type": "filename", "uuid": "98cc784e-25af-4dd3-8739-f36c97e68f2f", "value": "zbetcheckin_tracker_sh4" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689398", "to_ids": false, "type": "text", "uuid": "a24707dd-ffbc-4f0e-9ee1-349ae3f299a8", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Gafgyt.P!MTB\nVT Total Detection:42/65\nFirst Submission:2025-05-03T02:07:38.000000+00:00\nLast Submission:2025-05-03T02:07:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693676", "uuid": "8747121f-e9ab-47c4-9e2a-3282c0521639", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693676", "to_ids": true, "type": "md5", "uuid": "56e0b888-02c1-4601-af45-337c4d26dfd8", "value": "b3843345be4810ca5e116224b3d247c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692028", "to_ids": true, "type": "sha1", "uuid": "7d45d9a2-14ea-4b63-bcca-f18a0298ff07", "value": "7cdd37a9c8a2b4b814fc2308eb00babe154b9664", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692028", "to_ids": true, "type": "sha256", "uuid": "11ed4c8b-cdd3-4dd2-bdcb-ff2538308c96", "value": "9df711c3aef2bba17b622ddfd955452f8d8eb55899528fbc13d9540c52f13402", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689420", "to_ids": true, "type": "ssdeep", "uuid": "09dcbc1a-6a3e-4bd1-a1c3-2df3c6417cca", "value": "3072:ZUIK7u7U/0VjLoXUgS3wEa36BajITCW3R5Rpx:ZUruU2oXVS3la2nP3R5Rr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689420", "to_ids": false, "type": "size-in-bytes", "uuid": "b4685e8b-6ed4-499b-8a6d-7d6648165d3f", "value": "143292" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689420", "to_ids": true, "type": "vhash", "uuid": "83052f42-1f5e-4c69-8133-c092f5f5c243", "value": "8392799d7739ad72225fd3b9fa512aa9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689420", "to_ids": true, "type": "filename", "uuid": "9f3fd1bf-3329-4b2d-a2dc-0853dc8e1b91", "value": "arm6" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689420", "to_ids": false, "type": "text", "uuid": "822768d9-b114-449f-beab-0f5701f5561e", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.AW!xp\nVT Total Detection:45/65\nFirst Submission:2025-05-03T02:03:46.000000+00:00\nLast Submission:2025-05-03T02:03:46.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693698", "uuid": "9071fb7b-9b3f-4ca8-a275-57716e8edb70", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693698", "to_ids": true, "type": "md5", "uuid": "d9c0f58f-1b64-4605-b44b-ec087b7c7f22", "value": "db1dbfaef3362672d6bb89330b5fbb06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692029", "to_ids": true, "type": "sha1", "uuid": "cf2c774a-aac5-4c56-af35-ed5edbdf5b42", "value": "70f964338fc891891bd70ff9393546729333ee89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692029", "to_ids": true, "type": "sha256", "uuid": "ab592659-bfe2-4283-bc07-5fe7824af35c", "value": "7bbb21fec19512d932b7a92652ed0c8f0fedea89f34b9d6f267cf39de0eb9b20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689442", "to_ids": true, "type": "ssdeep", "uuid": "dbe916e2-65ea-41ad-b637-5736c21af60e", "value": "3072:jr/dsFezlTERakAajYFyisk5ybXCUBps4/hJjogM/RIyOGd:jr/RlT89AajYFybkAZBG4/XMgM/RIyOy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689442", "to_ids": false, "type": "size-in-bytes", "uuid": "b6ac26c5-84fe-4976-9513-2dd02a0a8ad3", "value": "179813" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689442", "to_ids": true, "type": "vhash", "uuid": "b48e8f50-4908-4076-964e-a51be3476e67", "value": "a7f48e34eef799b661f4a12935863b0a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689442", "to_ids": true, "type": "filename", "uuid": "abdc080a-7ca1-401b-af36-733d49b7d0ad", "value": "arm7" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689442", "to_ids": false, "type": "text", "uuid": "7f9ce0f0-b48c-4fb8-a219-68b202d3d85e", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.AW!xp\nVT Total Detection:46/65\nFirst Submission:2025-05-03T02:03:49.000000+00:00\nLast Submission:2025-05-03T10:34:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693719", "uuid": "c75eb1fc-94b5-435b-bf61-b050e9de58a9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693719", "to_ids": true, "type": "md5", "uuid": "0cca996a-bcc8-4705-ae04-164c3263fe48", "value": "4543b9ac3ba5f4e7f8e18d130f31e552", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692030", "to_ids": true, "type": "sha1", "uuid": "db18af66-3099-4b0e-8b27-8b6c6a41f48a", "value": "3693318e02ca114fcd6073b541f1d1e90a18cc43", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692030", "to_ids": true, "type": "sha256", "uuid": "d870661d-d5ea-4cff-8295-968e01de4be0", "value": "4caaa18982cd4056fead54b98d57f9a2a1ddd654cf19a7ba2366dfadbd6033da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689464", "to_ids": true, "type": "ssdeep", "uuid": "be543e7a-b786-4039-947f-39b075e52873", "value": "1536:J9v+s43G5bUWkIRAbSh71QAFMxK4VIGUT2y5OpO/fgA46nKthlcywyw1FrR7XVb7:Lv+XQbRIg71QNE43Uqy5OpOl46KbcbK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689464", "to_ids": false, "type": "size-in-bytes", "uuid": "830b2231-fb67-41cb-acac-2e42f7feb23b", "value": "129792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689464", "to_ids": true, "type": "vhash", "uuid": "1837c989-c8fa-45e5-a58d-69c786cbcc71", "value": "426177b03c790aee4e600a6d3ca1675e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689464", "to_ids": true, "type": "filename", "uuid": "d09b0e72-c86d-40d8-b704-2059d84a3df8", "value": "arm5" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689464", "to_ids": false, "type": "text", "uuid": "ce1e6bed-6704-4c16-813a-aa43aeaf53b5", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.AW!xp\nVT Total Detection:45/65\nFirst Submission:2025-05-03T02:03:58.000000+00:00\nLast Submission:2025-05-03T02:03:58.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693740", "uuid": "a400033e-0c2c-4016-b946-6c3ecfa58f8a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693740", "to_ids": true, "type": "md5", "uuid": "9fab4361-0917-4ca1-b48a-edc4751260f3", "value": "77825aac7f035fa0a94f4ff35177b503", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692030", "to_ids": true, "type": "sha1", "uuid": "6eb70809-efe4-4d95-a0e0-b3937f902265", "value": "23cad1f5b3b6776d26ae401688d4d2484917de27", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692031", "to_ids": true, "type": "sha256", "uuid": "ce60c3c2-e684-4c20-ace2-5cc5f85ab30d", "value": "534b654531a6a540a144da9545ee343e1046f843d7de4c1091b46c3ee66a508b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689486", "to_ids": true, "type": "ssdeep", "uuid": "e1f08f5a-6e28-44ff-9b8f-4c23398f5d04", "value": "1536:yl2JvnXPvLoQ+chMJdDNsCK9HFP18tOQGgezLiM+C27TfF+h/iuf/P/zNd/o:ygv/ecwZsCK9ltSOQ+LidFS/v/PbNVo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689486", "to_ids": false, "type": "size-in-bytes", "uuid": "de79c586-5281-426e-9464-f55c64bc9859", "value": "173796" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689486", "to_ids": true, "type": "vhash", "uuid": "b5b9b8ac-d94d-471f-bcd9-906335bc4a0a", "value": "fc7e3765fca30728af4e7f15eb3a548f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689486", "to_ids": true, "type": "filename", "uuid": "78d9fe02-7ff2-498f-b767-7f3a7a35810b", "value": "mips" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689486", "to_ids": false, "type": "text", "uuid": "b3060d6f-1ab2-464d-a9d8-3c217f887ee1", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.EF!MTB\nVT Total Detection:45/65\nFirst Submission:2025-05-03T01:59:59.000000+00:00\nLast Submission:2025-05-05T02:30:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693761", "uuid": "ce206fca-b1e9-4a0d-8f95-06bf798b5406", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693761", "to_ids": true, "type": "md5", "uuid": "f3bf8477-4995-44c8-bdf0-0a9d5e2d156b", "value": "2ae3d81112d9459045e6279fb7d013b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692031", "to_ids": true, "type": "sha1", "uuid": "17982f9e-a7da-4244-9781-5e00cc800c61", "value": "c2cc464588846692f67bb9abdde5fedb88d0cb21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692031", "to_ids": true, "type": "sha256", "uuid": "0d49f6e3-262b-4240-800f-2fa9aab0c9cd", "value": "56f21f412e898ad9e3ee05d5f44c44d9d7bcb9ecbfbdb9de11b8fa5a637aeef6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689508", "to_ids": true, "type": "ssdeep", "uuid": "e4b28fd6-f1ad-4086-9b3f-b0fc5b355d8d", "value": "3072:tGtwnNiaOnUTNFKPT9OSQ7AOaogjV2iZlBWCg5iA/QPdL:tGtwnNiaOnUT7uLyj/QPd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689508", "to_ids": false, "type": "size-in-bytes", "uuid": "31040b42-56db-4ae2-94d9-ae360a6e97f2", "value": "139576" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689508", "to_ids": true, "type": "vhash", "uuid": "443225f2-c8b1-4b90-8e9c-243fca95acec", "value": "397d54c63083e25930f53124b80ac614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689508", "to_ids": true, "type": "filename", "uuid": "ede359d5-5bc9-45b4-9a51-5903e7646a35", "value": "x86_64" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689508", "to_ids": false, "type": "text", "uuid": "146d7e34-8bdd-4575-8fc7-bef8f4f27d66", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.DZ!MTB\nVT Total Detection:44/65\nFirst Submission:2025-05-03T02:03:55.000000+00:00\nLast Submission:2025-05-03T10:30:08.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693782", "uuid": "760960ca-f387-447a-8161-1e91baae1bf6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693782", "to_ids": true, "type": "md5", "uuid": "0fecbdf1-da9b-4ea6-a8d7-029498973f96", "value": "e7efe76a253a37e0f92ff1dbe3caf3e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692032", "to_ids": true, "type": "sha1", "uuid": "1565df4d-b799-44fb-a76d-1f1227ae82ba", "value": "4f56614a69d7d6adbb994e3e3da54d1bcd9bb0b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692032", "to_ids": true, "type": "sha256", "uuid": "2d2b52f2-51d3-4b3f-a929-1dae0b6f2e94", "value": "3fbd2a2e82ceb5e91eadbad02cb45ac618324da9b1895d81ebe7de765dca30e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689529", "to_ids": true, "type": "ssdeep", "uuid": "e1ad3597-7b07-45fb-bea0-ec0c60b8fe35", "value": "3072:gHZ+XDAoxxFOV48wlPtjsRraPuk81mOw9LG0ibS:gHZUAGAV48MPtjuI9q0iG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689529", "to_ids": false, "type": "size-in-bytes", "uuid": "2a5d2770-690b-47bc-b68c-c1332e6af3f9", "value": "133888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689529", "to_ids": true, "type": "vhash", "uuid": "fd836c2e-3b2c-46bb-9129-59e858c4c241", "value": "426177b03c790aee4e600a6d3ca1675e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689529", "to_ids": true, "type": "filename", "uuid": "7c02f880-61e6-4ee5-8aae-d382c47b7d65", "value": "arm.elf" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689529", "to_ids": false, "type": "text", "uuid": "0ae097f9-170e-46e2-a1a8-04063c35462b", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.AW!xp\nVT Total Detection:43/65\nFirst Submission:2025-05-03T02:03:53.000000+00:00\nLast Submission:2025-05-03T10:49:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693804", "uuid": "6e9e44b0-3aa0-47d8-9aae-9370e85f7fd4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693804", "to_ids": true, "type": "md5", "uuid": "0cbde2d8-4b50-468d-a998-72b68f88c79c", "value": "ddf7214fd13a9a614a4995e37b804ce9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692033", "to_ids": true, "type": "sha1", "uuid": "8bec8090-ceea-474a-abef-42d70834bccb", "value": "556735a44101d7773226f44f9ba86cdf9753d7f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692033", "to_ids": true, "type": "sha256", "uuid": "da8ed693-4afc-4655-9805-e06883705c57", "value": "00078aeeaca54b5d3c1237e964e9f956690b782e4ea160d81edc3c6b44e7f620", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689551", "to_ids": true, "type": "ssdeep", "uuid": "c0a80c0d-38fe-4247-9c06-b4697b0a58c6", "value": "49152:6m/QejCCuR5QDrN+4vJksDo/VvQH9y3U6A0mRWHTBk1LNVq97UHSFloqS0iGyJsh:N/bksDo/VvQH9y3U6A0mRWHTBk1LNVqn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689551", "to_ids": false, "type": "size-in-bytes", "uuid": "e3f4722c-93db-44a3-8f03-1f5282140971", "value": "1731152" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1776689551", "to_ids": true, "type": "vhash", "uuid": "091083e5-da84-48ab-b159-26893d9beccd", "value": "606694b7f9516e1e9d7c6089b0b1f071" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689551", "to_ids": true, "type": "filename", "uuid": "3b96be17-0bc9-4550-8a9f-c4c1e0ed13f7", "value": "f69gyilb.exe" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 20/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689551", "to_ids": false, "type": "text", "uuid": "79333545-f22c-4a4d-8b86-363d091c2c13", "value": "Type Description: ELF\nMicrosoft: None\nVT Total Detection:0/64\nFirst Submission:2026-01-13T22:09:59.000000+00:00\nLast Submission:2026-01-13T22:09:59.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1776693825", "uuid": "d8abee58-d242-4b28-8958-e8c7a0cc8a4a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1776693825", "to_ids": true, "type": "md5", "uuid": "c4494d32-dee2-4095-a171-3537d755bc1d", "value": "3c81fc3681847f53d3a6198a76b35241", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1776692034", "to_ids": true, "type": "sha1", "uuid": "92e88013-43f9-4727-8faa-13a660d62b1a", "value": "10e98f54673aeeed856f1eceb18bc9c4a15c0e0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1776692034", "to_ids": true, "type": "sha256", "uuid": "64fba895-67a9-46d3-8ff8-4e25132b6519", "value": "c321933e4e5970ba7299fe21778dab9398994c22ca0ba0422c6cbc3fbb95ea26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1776689573", "to_ids": true, "type": "ssdeep", "uuid": "4d4d144b-3f9d-4aa2-9862-51391df1962d", "value": "98304:fxjjl8ZAgBvsaS17G/kieUFA6jGXjoRBzrljWvv2:fxjjl86gJsac7GcTkGzonfpWH2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1776689573", "to_ids": false, "type": "size-in-bytes", "uuid": "7ede5918-6998-46f3-905b-6f0f198ed971", "value": "4063744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1776689573", "to_ids": true, "type": "filename", "uuid": "fdd378b7-74d4-469c-92d6-6af6e5a6a7cb", "value": "wr940nv4_us_3_16_9_up_boot(160617).bin" }, { "category": "Other", "comment": "Checked: 20/04/2026\nLast-scan\t: 18/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1776689573", "to_ids": false, "type": "text", "uuid": "6c57093b-5df9-425e-8a8e-d7205c25721d", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:0/62\nFirst Submission:2023-02-07T09:55:17.000000+00:00\nLast Submission:2023-05-19T07:07:04.000000+00:00" } ] } ] } }