{ "Event": { "analysis": "1", "date": "2026-07-06", "extends_uuid": "", "info": "[Threat Intel] Cavern Manticore: Exposing Iran-Linked Modular C2 Framework", "protected": false, "publish_timestamp": "1784321935", "published": true, "threat_level_id": "1", "timestamp": "1784321935", "uuid": "fdd5e520-377f-4a1a-9a18-5ae38571e619", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#5dfed4", "local": false, "name": "misp-galaxy:producer=\"Check Point\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"", "relationship_type": "" }, { "colour": "#6aef97", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSA Secrets - T1003.004\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1087.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#041edc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"", "relationship_type": "" }, { "colour": "#e7d11f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#673bb0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Groups - T1069.001\"", "relationship_type": "" }, { "colour": "#e66f0c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Accounts - T1078.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#c295b4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "relationship_type": "" }, { "colour": "#26fab6", "local": false, "name": "misp-galaxy:target-information=\"Israel\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#1c006d", "local": false, "name": "rectifyq:topic=\"geopolitical\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"SysAid\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"LYCEUM\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MuddyWater\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783508417", "to_ids": false, "type": "link", "uuid": "52af84a0-d090-440a-8189-c9b17724f401", "value": "https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783508417", "to_ids": false, "type": "text", "uuid": "b9f51141-9a65-4d90-b1c9-d0f34f75eab8", "value": "Check Point Research tracks Cavern Manticore, an Iran-nexus threat actor targeting Israeli government and IT sectors. The actor deploys a modular C2 framework built on .NET but compiled into different formats including Mixed-Mode C++/CLI and Native AOT, creating significant anti-analysis challenges. The framework consists of core agents and specialized post-exploitation modules providing capabilities for file system operations, database browsing, LDAP querying, network reconnaissance, and tunneling. Initial access is achieved through abuse of Remote Monitoring and Management software like SysAid. The actor demonstrates supply-chain compromise tactics, using IT providers as stepping stones to reach higher-value targets. Technical overlaps link Cavern Manticore to Iranian MOIS-aligned groups including MuddyWater and Lyceum subgroup of OilRig." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783508417", "to_ids": false, "type": "text", "uuid": "b8c1dec8-79ab-46bc-afae-5a7d42c3de3a", "value": "Name: Cavern Manticore: Exposing Iran-Linked Modular C2 Framework\nAuthor: AlienVault\nAdversary: Cavern Manticore\nTags: [\"modular c2 framework\", \"rmm abuse\", \"sysaid\", \"supply-chain compromise\", \"iran\", \"nativeaot compilation\", \"mois\", \"dll sideloading\"]\nTgtd countries: [\"Israel\"]\nMlwr families: []\nAttack_ids: [\"T1560.001\", \"T1132.001\", \"T1110.001\", \"T1003.004\", \"T1087.002\", \"T1573.001\", \"T1087.001\", \"T1135\", \"T1219\", \"T1218\", \"T1021.002\", \"T1552.004\", \"T1016\", \"T1482\", \"T1083\", \"T1049\", \"T1069.001\", \"T1078.002\", \"T1071.001\", \"T1018\", \"T1046\", \"T1574.002\", \"T1090.001\"]\nIndustries: [\"Government\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784302849", "to_ids": false, "type": "threat-actor", "uuid": "f0f182e1-0963-4bf3-adf6-4d39faa5d0bf", "value": "Cavern Manticore", "Tag": [ { "colour": "#5dfed4", "local": false, "name": "misp-galaxy:producer=\"Check Point\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307348", "to_ids": true, "type": "hostname", "uuid": "80169f2f-5617-4581-8135-f5f947e9387f", "value": "auth.hospitalinstallation.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307369", "to_ids": true, "type": "url", "uuid": "6284a0dd-df87-4214-a97d-6c63e8898298", "value": "https://adserviceupdate.com/cac.aspx", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307390", "to_ids": true, "type": "url", "uuid": "ce73d26e-1ac1-48bb-85ca-1344e51b70d7", "value": "https://hygienehistory.com/cac.aspx", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307411", "to_ids": true, "type": "domain", "uuid": "52874d35-a31d-4150-b56c-18b34808705c", "value": "adserviceupdate.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307432", "to_ids": true, "type": "domain", "uuid": "2c870ba4-1f29-4189-96f3-54cafc6089c9", "value": "hospitalinstallation.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307454", "to_ids": true, "type": "domain", "uuid": "3f439bb4-7f3c-49dd-a0e7-a1858038314a", "value": "hygienehistory.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307475", "to_ids": true, "type": "hostname", "uuid": "abe8bac5-fed9-4337-973e-5a45494bc138", "value": "google.com.hospitalinstallation.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307496", "uuid": "6f3c9816-8edf-4446-b865-f4863a43643b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "md5", "timestamp": "1784307496", "to_ids": true, "type": "md5", "uuid": "9655f09e-7b14-4e2e-8d02-2aac2ef185d2", "value": "a9336884e006503bc821f3f0d36f141f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "sha1", "timestamp": "1784305123", "to_ids": true, "type": "sha1", "uuid": "093271a1-e94a-4ebd-9a66-e22401b79bb0", "value": "0f57a2bb4c0696170b73e2d35f17c5a6f2f910d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "sha256", "timestamp": "1784305123", "to_ids": true, "type": "sha256", "uuid": "13340b9a-7af4-4d36-9930-721b1eb5119e", "value": "541b1f417b9e42078c3355693a8a492b6a76048850f6549a429e0be99e6819cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "text", "timestamp": "1784304499", "to_ids": false, "type": "text", "uuid": "8c222297-82c0-48a3-bb63-002148a518cf", "value": "Type Description: Win32 DLL\nOriginal name: CVNAM.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2025-12-18T14:33:58+00:00\nFirst Submission: 2025-12-18T12:31:44+00:00\nLast Submission: 2026-03-19T16:25:38+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "creation-time", "timestamp": "1784304499", "to_ids": false, "type": "datetime", "uuid": "ac042f5c-883e-4819-82de-bb992bc8136b", "value": "2025-11-15T12:07:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "ssdeep", "timestamp": "1784304499", "to_ids": true, "type": "ssdeep", "uuid": "dfa0606c-505c-41a1-998b-bdc4b7a0e544", "value": "1536:7HZ1T5rdR26S3cobmZf1IdIml/jigYL4vmUwDY7QPBsu41fi2UmDf4uqA4zgRt:zRMJwuiBWmUJVu4xi2wuqAMgRt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304499", "to_ids": false, "type": "size-in-bytes", "uuid": "eb619d39-55f8-4276-8288-ca878d71251d", "value": "128512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "vhash", "timestamp": "1784304499", "to_ids": true, "type": "vhash", "uuid": "7f83537b-a516-4797-bc65-8797b2c2fe2d", "value": "3150465d1515120091b7021z1020" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-18T12:31:44+00:00", "last_seen": "2026-03-19T16:25:38+00:00", "object_relation": "filename", "timestamp": "1784304499", "to_ids": true, "type": "filename", "uuid": "28b76397-6f6b-47e1-8a87-5bee0ffd90f6", "value": "CVNAM.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307517", "uuid": "8a07c352-68f5-4081-bbce-8656b68d42b0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "md5", "timestamp": "1784307517", "to_ids": true, "type": "md5", "uuid": "ad3dea16-fb8c-4fd7-b66c-4efd72a5d4d0", "value": "d0bba7c040ecffd8cc31a62330a144eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "sha1", "timestamp": "1784305124", "to_ids": true, "type": "sha1", "uuid": "12731c29-0aaa-4ddc-bfb0-df2f50a42c41", "value": "843d2017c4ded1dbb694dd4bf20bcd9e92af92f6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "sha256", "timestamp": "1784305124", "to_ids": true, "type": "sha256", "uuid": "06687870-ffd8-4972-836a-5ef2e13ac225", "value": "ccf218189c3aadb1c761da14bfda3bae686769031e1e1b10007648bd72e34748", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "text", "timestamp": "1784304520", "to_ids": false, "type": "text", "uuid": "eae269ad-f139-475d-9c51-dd8d767576cc", "value": "Type Description: Win32 DLL\nOriginal name: CVNHDM.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 39/74\nFirst Seen In The Wild: 2025-12-18T14:30:11+00:00\nFirst Submission: 2025-12-18T12:29:55+00:00\nLast Submission: 2026-03-19T16:26:41+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "creation-time", "timestamp": "1784304520", "to_ids": false, "type": "datetime", "uuid": "04a961a7-c9ef-46f4-874e-16387ec0470c", "value": "2025-11-15T12:07:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "ssdeep", "timestamp": "1784304520", "to_ids": true, "type": "ssdeep", "uuid": "8dbe5dc1-72c3-480b-9559-be9b496446f1", "value": "384:eMobBsyA4E1mv6MT/RkDnoM3aE0+WjWkErUDnqJtxI6n:eWv5mDTZSoNxEvfn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304520", "to_ids": false, "type": "size-in-bytes", "uuid": "6fa8d9b9-fa0f-45c4-b738-475a1fd5624f", "value": "17920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "vhash", "timestamp": "1784304520", "to_ids": true, "type": "vhash", "uuid": "fd21d42d-f0ca-4bbd-a507-99bf063fc70d", "value": "3140465d151511309a1940052" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-18T12:29:55+00:00", "last_seen": "2026-03-19T16:26:41+00:00", "object_relation": "filename", "timestamp": "1784304520", "to_ids": true, "type": "filename", "uuid": "f6c5210f-5086-43d5-99e7-c34b6a14110a", "value": "CVNHDM.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307538", "uuid": "3b4eba90-820a-44e8-9f2a-1510d6d0a542", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "md5", "timestamp": "1784307538", "to_ids": true, "type": "md5", "uuid": "2d8c36eb-45ba-4f95-b293-6f55a74b5003", "value": "493a0ca52618a045b07f7c655f17b846", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "sha1", "timestamp": "1784305125", "to_ids": true, "type": "sha1", "uuid": "2ac68df4-a23f-43de-9750-8522b1879647", "value": "f14f903040c73603f1940151ed058b0aa7639919", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "sha256", "timestamp": "1784305125", "to_ids": true, "type": "sha256", "uuid": "3762594a-b723-4fa3-897c-33738bbb2348", "value": "0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "text", "timestamp": "1784304542", "to_ids": false, "type": "text", "uuid": "7c0256fd-8c56-4088-8521-b7a52da938b3", "value": "Type Description: Win32 DLL\nOriginal name: MHM.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2026-04-28T10:50:08+00:00\nFirst Submission: 2026-04-27T13:04:36+00:00\nLast Submission: 2026-04-27T13:04:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "creation-time", "timestamp": "1784304542", "to_ids": false, "type": "datetime", "uuid": "83f24dad-5f44-4638-8092-d412ad12c356", "value": "2074-10-14T01:08:27+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "ssdeep", "timestamp": "1784304542", "to_ids": true, "type": "ssdeep", "uuid": "c95a755c-264c-424e-8c31-5bf435266822", "value": "768:dnPY9KUTXTyScBf6ym5p4H7kkZcZ1Z5O:9A9DyXf66rqZ1Zo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304542", "to_ids": false, "type": "size-in-bytes", "uuid": "e9b10628-7053-4f44-be99-899bc615e568", "value": "44544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "vhash", "timestamp": "1784304542", "to_ids": true, "type": "vhash", "uuid": "c76950cf-c3bc-4e91-9d3d-4d55277f4711", "value": "144026551\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:04:36+00:00", "last_seen": "2026-04-27T13:04:36+00:00", "object_relation": "filename", "timestamp": "1784304542", "to_ids": true, "type": "filename", "uuid": "86a18bf4-d747-49bf-9b67-7445b59a48e1", "value": "MHM.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307559", "uuid": "4f04c24c-5892-4ffc-b38f-e100f26a8652", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "md5", "timestamp": "1784307559", "to_ids": true, "type": "md5", "uuid": "5f38e861-eb79-4525-a2fc-1f6bf6037d33", "value": "99ad565d87a13cf2cac1b60b9fe29847", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "sha1", "timestamp": "1784305126", "to_ids": true, "type": "sha1", "uuid": "3b391fcd-b506-4368-a607-77daf88adf61", "value": "dd3c301d9ee494d60be622399d167049768ec7be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "sha256", "timestamp": "1784305126", "to_ids": true, "type": "sha256", "uuid": "2ac4d9bc-209c-4d02-afd6-63f073c5ad15", "value": "2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "text", "timestamp": "1784304563", "to_ids": false, "type": "text", "uuid": "808b770e-a81c-4581-af71-a4e4fc35291b", "value": "Type Description: Win32 DLL\nOriginal name: n-ten.dll\nMicrosoft: Trojan:Win32/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Seen In The Wild: 2026-04-28T14:19:11+00:00\nFirst Submission: 2026-04-28T12:18:50+00:00\nLast Submission: 2026-04-28T12:18:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "creation-time", "timestamp": "1784304564", "to_ids": false, "type": "datetime", "uuid": "e1d76a1d-053a-4ab8-bdbc-96284b6c3e80", "value": "2026-04-23T14:35:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "ssdeep", "timestamp": "1784304563", "to_ids": true, "type": "ssdeep", "uuid": "bc812407-04c0-4382-a9fe-5335ebab6768", "value": "49152:rNmm5xLovvs0orqq+4jJl7O0jeaodRWK2Lguv15y8GgEi32o:uPxCJyaodRW3L9yk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304563", "to_ids": false, "type": "size-in-bytes", "uuid": "6830e857-5924-48af-b6d9-3d73d606dc93", "value": "3092992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "vhash", "timestamp": "1784304563", "to_ids": true, "type": "vhash", "uuid": "7a52b881-40df-4b3c-aee1-7c01fdab2c48", "value": "136086666c056d1565155078z837z6kz146z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T12:18:50+00:00", "last_seen": "2026-04-28T12:18:50+00:00", "object_relation": "filename", "timestamp": "1784304563", "to_ids": true, "type": "filename", "uuid": "b1074348-cc6b-493d-83bb-769bbc3d4428", "value": "n-ten.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307580", "uuid": "c2a48c79-9cf6-4cc8-9a12-f718faa07683", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "md5", "timestamp": "1784307580", "to_ids": true, "type": "md5", "uuid": "d3224338-3acd-43c3-ba46-da5f2d3c141d", "value": "99385a56be3fb0f1c10eb4fa9557bff2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "sha1", "timestamp": "1784305128", "to_ids": true, "type": "sha1", "uuid": "49008475-b585-41c7-94e4-7f77c5f8393a", "value": "aad31026fb62339256765eb46a8352fdf09ead4a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "sha256", "timestamp": "1784305128", "to_ids": true, "type": "sha256", "uuid": "98a3a641-f1b6-45b3-96b0-2476ae2298aa", "value": "30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a10", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "text", "timestamp": "1784304585", "to_ids": false, "type": "text", "uuid": "adadc816-b505-485d-9853-12badc56dab1", "value": "Type Description: Win32 DLL\nOriginal name: ode.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 33/74\nFirst Seen In The Wild: 2026-04-28T13:33:53+00:00\nFirst Submission: 2026-04-28T11:31:57+00:00\nLast Submission: 2026-04-28T11:31:57+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "creation-time", "timestamp": "1784304585", "to_ids": false, "type": "datetime", "uuid": "dfc27820-eb3d-4330-b38f-4b049a05cf6a", "value": "2046-06-28T01:42:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "ssdeep", "timestamp": "1784304585", "to_ids": true, "type": "ssdeep", "uuid": "60907f98-9121-4ccf-83f5-c0bd38e99881", "value": "384:VayqfohxbT0dWLIT1ff9dUWf+pRN1pSGY7+Q4E7KgJ7Yy5/i3hebQgxtUQ6M7nFv:dYdaY737KY7YnYEuUonFP//3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304585", "to_ids": false, "type": "size-in-bytes", "uuid": "3b400599-67c3-4ab6-b83b-ac1a49f4a0d0", "value": "33792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "vhash", "timestamp": "1784304585", "to_ids": true, "type": "vhash", "uuid": "a6e289b8-c9f9-4da0-88d5-f9d803a0049c", "value": "33403655151100821ca0026" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:31:57+00:00", "last_seen": "2026-04-28T11:31:57+00:00", "object_relation": "filename", "timestamp": "1784304585", "to_ids": true, "type": "filename", "uuid": "0a00f870-cd28-40f4-a40f-ecbedd415e18", "value": "ode.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307602", "uuid": "3994239d-6ed1-458e-b66a-81f9545e3c8e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "md5", "timestamp": "1784307602", "to_ids": true, "type": "md5", "uuid": "01aecde6-79f2-4ccd-9e65-3845ac7e763a", "value": "630ac9c0e33fa96a6c73267328aa0051", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "sha1", "timestamp": "1784305129", "to_ids": true, "type": "sha1", "uuid": "552d86ad-9540-4d3c-94da-07c4df169a83", "value": "a52cc6f76de70e4e312655ce77409683d9d00696", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "sha256", "timestamp": "1784305129", "to_ids": true, "type": "sha256", "uuid": "1bcd567f-2791-42b6-8797-11d29fd1c692", "value": "37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "text", "timestamp": "1784304607", "to_ids": false, "type": "text", "uuid": "ff00433d-aaf6-4e9e-b0d9-f8840143e58d", "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:MSIL/BlueOtter.A!dha\nClamAV: None\nVT Total Detection: 38/74\nFirst Seen In The Wild: 2026-04-28T13:39:59+00:00\nFirst Submission: 2026-04-28T11:59:55+00:00\nLast Submission: 2026-04-28T12:01:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "creation-time", "timestamp": "1784304607", "to_ids": false, "type": "datetime", "uuid": "9fd74fc9-0088-49c4-a5c4-ad79a21b4851", "value": "2026-04-26T05:16:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "ssdeep", "timestamp": "1784304607", "to_ids": true, "type": "ssdeep", "uuid": "9d2a8b50-e6d6-4329-83b5-9c84cf41994e", "value": "3072:0sNYEg6ONarv0E4U6/muxwFJeE0OPH8YoAjXc42wJL:0seQJl4U6/muxwFJeE0OPH8ZoYwJL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304607", "to_ids": false, "type": "size-in-bytes", "uuid": "9b0666a0-a5a1-46af-b25f-e129ad745f2c", "value": "200192" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "vhash", "timestamp": "1784304607", "to_ids": true, "type": "vhash", "uuid": "71842b33-ecfa-450d-bece-14f8b9cf283e", "value": "12507656156d1515551az22wz383z53" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:59:55+00:00", "last_seen": "2026-04-28T12:01:20+00:00", "object_relation": "filename", "timestamp": "1784304607", "to_ids": true, "type": "filename", "uuid": "93eef251-59d5-4c2f-bc91-0821e3abf50b", "value": "4vp12y3j.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307624", "uuid": "a47163f9-5db1-4eff-b5d0-6184ff5b06b8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "md5", "timestamp": "1784307624", "to_ids": true, "type": "md5", "uuid": "60663a61-c9fb-4c84-8bf0-a9df75bbe27b", "value": "3c3b9a8a770ab352541127089fb2bdd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "sha1", "timestamp": "1784305130", "to_ids": true, "type": "sha1", "uuid": "16bc2582-1c99-45a5-9d8f-f47429d862d0", "value": "d5377f02e57c8f86e0e38375a2c9a9565fe74822", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "sha256", "timestamp": "1784305130", "to_ids": true, "type": "sha256", "uuid": "d3aa4a55-a15b-466a-8423-a0359c21e275", "value": "5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b42", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "text", "timestamp": "1784304628", "to_ids": false, "type": "text", "uuid": "9030be6e-e290-4ac0-99ef-61a51ba85aac", "value": "Type Description: Win32 DLL\nOriginal name: db.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Seen In The Wild: 2026-04-28T13:40:00+00:00\nFirst Submission: 2026-04-28T11:37:16+00:00\nLast Submission: 2026-04-28T11:37:16+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "creation-time", "timestamp": "1784304628", "to_ids": false, "type": "datetime", "uuid": "573c3ac0-98f3-40d5-905a-b772220f2184", "value": "2073-09-03T13:22:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "ssdeep", "timestamp": "1784304628", "to_ids": true, "type": "ssdeep", "uuid": "744ebeb7-5838-416c-aebe-383a0cf05340", "value": "384:dudI4s+waO2589AcxOCMaLDyGyHZwKfW2dvujXiQXSYVG:UikXDeUyDlyS8ujyQXSYVG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304628", "to_ids": false, "type": "size-in-bytes", "uuid": "aca9688e-5a32-47d6-a84e-764706a66b2a", "value": "25088" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "vhash", "timestamp": "1784304628", "to_ids": true, "type": "vhash", "uuid": "281a6ece-6e98-4ace-b0cd-c7bd67c6c73f", "value": "324036551511208118e0024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:37:16+00:00", "last_seen": "2026-04-28T11:37:16+00:00", "object_relation": "filename", "timestamp": "1784304628", "to_ids": true, "type": "filename", "uuid": "706194e8-a511-4459-94af-f424923fb4ad", "value": "db.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307645", "uuid": "25ba999f-8e8a-4410-9830-3c71355f81da", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "md5", "timestamp": "1784307645", "to_ids": true, "type": "md5", "uuid": "522ced4d-b599-44a7-a65d-beb13d57ab87", "value": "8b630b2b46c01770d3d9bb7f0c7c9c50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "sha1", "timestamp": "1784305131", "to_ids": true, "type": "sha1", "uuid": "a31ee55d-1939-4f09-8c71-a38d93e6a061", "value": "ab7d45c6d8d748c75352a70d907153b61f790f60", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "sha256", "timestamp": "1784305131", "to_ids": true, "type": "sha256", "uuid": "3637f371-9ae0-426f-8d5a-72d3a6e8a9d9", "value": "5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "text", "timestamp": "1784304649", "to_ids": false, "type": "text", "uuid": "94246891-9c90-4d2e-8595-0e117e4e270d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 37/74\nFirst Seen In The Wild: 2026-04-28T10:56:21+00:00\nFirst Submission: 2026-04-27T13:05:39+00:00\nLast Submission: 2026-04-27T13:05:39+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "creation-time", "timestamp": "1784304649", "to_ids": false, "type": "datetime", "uuid": "60f2a50a-8dd3-4dd7-ae94-60f9a6295289", "value": "2026-04-14T08:43:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "ssdeep", "timestamp": "1784304649", "to_ids": true, "type": "ssdeep", "uuid": "1e7b6dce-02b5-42a8-9006-8ef33c7ca29a", "value": "1536:KtqRqCM3oU9bdTehzz2dZpQpDeJCD2zbpF4:KVF9ZKzadZJW2H4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304649", "to_ids": false, "type": "size-in-bytes", "uuid": "6bc868ed-52df-4d26-9092-199a0f8c2cb9", "value": "73728" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "vhash", "timestamp": "1784304649", "to_ids": true, "type": "vhash", "uuid": "27395942-5e39-4c8e-ac3c-a9b5d5f24f91", "value": "17407656155d1515551az1yz13z53" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-27T13:05:39+00:00", "last_seen": "2026-04-27T13:05:39+00:00", "object_relation": "filename", "timestamp": "1784304649", "to_ids": true, "type": "filename", "uuid": "e86d6ec4-0366-4882-8f71-0d7811995fb5", "value": "zujba.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307666", "uuid": "65124f77-372b-47af-b074-1f2d3039fb7a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "md5", "timestamp": "1784307666", "to_ids": true, "type": "md5", "uuid": "63b27d57-f140-4153-b095-1aa6233901fc", "value": "aace3725e941ff30b6d180e23003b1d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "sha1", "timestamp": "1784305132", "to_ids": true, "type": "sha1", "uuid": "c5efddb9-f0e5-49c2-b4f9-52810a52a454", "value": "48d4cd6c5f089a9e5666df8d9a8480cf6aa4b1c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "sha256", "timestamp": "1784305132", "to_ids": true, "type": "sha256", "uuid": "946c7ca3-9446-406f-937c-b3055b260bb8", "value": "7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "text", "timestamp": "1784304671", "to_ids": false, "type": "text", "uuid": "0951ee39-cf92-4de6-81a1-17ea48e1408f", "value": "Type Description: Win32 DLL\nOriginal name: n-sws.dll\nMicrosoft: Trojan:Win32/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 38/74\nFirst Seen In The Wild: 2026-04-28T11:58:29+00:00\nFirst Submission: 2026-04-28T10:22:09+00:00\nLast Submission: 2026-04-28T11:31:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "creation-time", "timestamp": "1784304671", "to_ids": false, "type": "datetime", "uuid": "fd67d312-2272-49d6-9a53-167c84cb65ee", "value": "2026-04-23T14:35:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "ssdeep", "timestamp": "1784304671", "to_ids": true, "type": "ssdeep", "uuid": "1fed11df-af49-4b9e-a27f-dde9856dbe23", "value": "49152:hhEBxQdeC0Spb5ZSmIYBVWJI4rFGDydMH0PzHulRcKh4hMRqnD5GxjFsojkrXkY+:piGV6DRCL4WjkjkXRN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304671", "to_ids": false, "type": "size-in-bytes", "uuid": "7a184e40-bd6c-440e-bbea-d5324b38c885", "value": "6003200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "vhash", "timestamp": "1784304671", "to_ids": true, "type": "vhash", "uuid": "73c7b5e1-c265-4699-9464-70f6df9e9196", "value": "166086666c056d15651550d2z212z937z7kz1b6z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:22:09+00:00", "last_seen": "2026-04-28T11:31:37+00:00", "object_relation": "filename", "timestamp": "1784304671", "to_ids": true, "type": "filename", "uuid": "c76e2dae-a112-4bda-8346-6b0db0b84c01", "value": "n-sws.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307687", "uuid": "135e9408-3c70-4f5e-985f-69144a730914", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "md5", "timestamp": "1784307687", "to_ids": true, "type": "md5", "uuid": "3e7746e5-6cd1-47b2-af53-d2f91ecc65f5", "value": "3beac724785d84cb4531cd067196d5b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "sha1", "timestamp": "1784305133", "to_ids": true, "type": "sha1", "uuid": "071ca2b4-3219-4b2b-9498-4616cc857568", "value": "964c4f8df6cea2eca3536ac6a3b46e1012ffba91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "sha256", "timestamp": "1784305133", "to_ids": true, "type": "sha256", "uuid": "151415be-1b00-4ec3-afc0-fc741d44c568", "value": "8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "text", "timestamp": "1784304692", "to_ids": false, "type": "text", "uuid": "4aaf48bb-e004-4583-9064-63679af3006f", "value": "Type Description: Win32 DLL\nOriginal name: mhm.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2026-04-28T11:58:31+00:00\nFirst Submission: 2026-04-28T10:17:58+00:00\nLast Submission: 2026-04-28T10:17:58+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "creation-time", "timestamp": "1784304692", "to_ids": false, "type": "datetime", "uuid": "072235b7-188e-4476-bb0e-01cd34be92de", "value": "2080-10-15T08:19:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "ssdeep", "timestamp": "1784304692", "to_ids": true, "type": "ssdeep", "uuid": "df53d29a-fc96-4450-85f0-1b53729217f3", "value": "768:AhP2Mi0KdI5TCX7EmUpZ10rmYj9kpTDI8cfDhuvlyw:p0KeUXomUpZ64DCoX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304692", "to_ids": false, "type": "size-in-bytes", "uuid": "c07fd070-f704-4732-be81-63d40018b983", "value": "53248" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "vhash", "timestamp": "1784304692", "to_ids": true, "type": "vhash", "uuid": "aefc53b0-1305-43c4-8a1d-908ee6a21e62", "value": "3540365515122081e401700c1c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T10:17:58+00:00", "last_seen": "2026-04-28T10:17:58+00:00", "object_relation": "filename", "timestamp": "1784304692", "to_ids": true, "type": "filename", "uuid": "f6bfec4c-fe20-4ae2-ad38-74d77bc83b44", "value": "mhm.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307709", "uuid": "012cc4d2-62a6-4910-968e-1a6cc3918b1d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "md5", "timestamp": "1784307709", "to_ids": true, "type": "md5", "uuid": "3382b552-998f-4632-b08e-199de752f4e2", "value": "e2aa78bf2d40775db15886c5270c2523", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "sha1", "timestamp": "1784305135", "to_ids": true, "type": "sha1", "uuid": "b22bf31e-9b3f-4a53-ab62-1fd4b68e77b6", "value": "85bfd461ac4299c277fe3b14f56a1ec2958bd71b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "sha256", "timestamp": "1784305135", "to_ids": true, "type": "sha256", "uuid": "dc94ead2-f79e-415c-8bc1-39a4c3e8e4ef", "value": "92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "text", "timestamp": "1784304714", "to_ids": false, "type": "text", "uuid": "5bc8be85-005b-41d3-9cb2-297b4c4e3899", "value": "Type Description: Win32 DLL\nMicrosoft: Backdoor:MSIL/BlueOtter.A!dha\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2026-04-28T12:16:34+00:00\nFirst Submission: 2026-04-28T08:28:53+00:00\nLast Submission: 2026-05-03T10:25:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "creation-time", "timestamp": "1784304714", "to_ids": false, "type": "datetime", "uuid": "5839e69b-89e0-49ba-a2d6-771ab127ef1d", "value": "2026-04-27T22:48:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "ssdeep", "timestamp": "1784304714", "to_ids": true, "type": "ssdeep", "uuid": "6727dbab-ee48-465c-9952-1d8eb0b12a65", "value": "3072:F0L+DqCoXe8x5Fb/mfxAFJeE0Oeu8YN1jW35KwEX:FitXxFb/mfxAFJeE0Oeu8MdwEX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304714", "to_ids": false, "type": "size-in-bytes", "uuid": "3ebf48d6-9292-4ded-ae9f-7b74198c9550", "value": "198656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "vhash", "timestamp": "1784304714", "to_ids": true, "type": "vhash", "uuid": "fe35c1ce-ccd3-4b28-993d-d4aca57984ea", "value": "11507656156d1515551az22wz383z53" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T08:28:53+00:00", "last_seen": "2026-05-03T10:25:50+00:00", "object_relation": "filename", "timestamp": "1784304714", "to_ids": true, "type": "filename", "uuid": "d940b241-148e-4fc5-a3bb-677ba57ac192", "value": "uxtheme.dllc6Pjr" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307730", "uuid": "9e970092-5d45-48e3-aec8-de5aac55494b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "md5", "timestamp": "1784307730", "to_ids": true, "type": "md5", "uuid": "089d67e6-8b06-4ba8-9414-fad080976cab", "value": "cbc329af864be261682a42a701b481cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "sha1", "timestamp": "1784305136", "to_ids": true, "type": "sha1", "uuid": "494da971-fbeb-4ef4-8d8b-f877d5fd7aaa", "value": "121093510a57b9e0d86bcc3072ed7b10e2ac2ff8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "sha256", "timestamp": "1784305136", "to_ids": true, "type": "sha256", "uuid": "232d1e32-4a06-4792-a316-5df70af153f9", "value": "a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "text", "timestamp": "1784304735", "to_ids": false, "type": "text", "uuid": "3c886b3c-7225-4905-9f81-c1ab2ab25055", "value": "Type Description: Win32 DLL\nOriginal name: n-htcommp.dll\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 40/74\nFirst Seen In The Wild: 2026-04-28T13:18:11+00:00\nFirst Submission: 2026-04-28T11:17:56+00:00\nLast Submission: 2026-07-14T06:37:24+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "creation-time", "timestamp": "1784304735", "to_ids": false, "type": "datetime", "uuid": "6226def2-6c97-4243-a6b1-700cfc35464e", "value": "2026-04-27T22:53:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "ssdeep", "timestamp": "1784304735", "to_ids": true, "type": "ssdeep", "uuid": "12f5b61e-0b92-403b-852a-86de5bf9b409", "value": "49152:OJzpcZCt+iAWt16qcSMZeUohHbDp8lZHvvvcl3V59RxHzcRgbuloLgVgFF/etB5a:J4OvSXp8ncz59RxDFoF/Fh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304735", "to_ids": false, "type": "size-in-bytes", "uuid": "5dcada22-eff4-4a42-af58-9c6204bbe28a", "value": "5580288" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "vhash", "timestamp": "1784304735", "to_ids": true, "type": "vhash", "uuid": "f1bd5e34-e30f-4127-831e-1891ef488d71", "value": "156086666c056d15651550b2z212z867z7kz186z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:17:56+00:00", "last_seen": "2026-07-14T06:37:24+00:00", "object_relation": "filename", "timestamp": "1784304735", "to_ids": true, "type": "filename", "uuid": "59ecc1ab-1365-45d6-97bd-ace88b1a6115", "value": "n-htcommp.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307751", "uuid": "284ea3da-e23a-46cc-85ce-4f07713a795c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "md5", "timestamp": "1784307751", "to_ids": true, "type": "md5", "uuid": "f66308f5-ae30-4d09-b94e-f3c8bae67e6f", "value": "5be0cc3f206a47d24d8a440d441696f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "sha1", "timestamp": "1784305137", "to_ids": true, "type": "sha1", "uuid": "d3106fc3-05e0-4e12-9057-19fc8f825598", "value": "ace2c11b0f493974508731692905c44e4da53166", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "sha256", "timestamp": "1784305137", "to_ids": true, "type": "sha256", "uuid": "25956ab5-fb5f-45c3-92d0-2b35b150857a", "value": "b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "text", "timestamp": "1784304757", "to_ids": false, "type": "text", "uuid": "03b75499-12cc-4369-8a25-3f9610405b7d", "value": "Type Description: Win32 DLL\nOriginal name: n-htcommp.dll\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2026-04-28T14:20:05+00:00\nFirst Submission: 2026-04-28T12:05:12+00:00\nLast Submission: 2026-04-28T12:05:12+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "creation-time", "timestamp": "1784304757", "to_ids": false, "type": "datetime", "uuid": "66f4a1b7-ff58-478d-bd69-ff3c60156fab", "value": "2026-04-25T22:47:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "ssdeep", "timestamp": "1784304757", "to_ids": true, "type": "ssdeep", "uuid": "c0098937-bd56-4812-8e27-3a0e6e247d67", "value": "49152:bUt1JNQlW+7sHKjpKGFjQeTLqry2fJhRFskj3QSEzn4DLKouHfP1qq+m+WruLDZ3:OicajphL+/sarEz46+FCfdYjHIVm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304757", "to_ids": false, "type": "size-in-bytes", "uuid": "13ed7c10-d244-4c1a-b89a-aa3340843fd5", "value": "5578240" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "vhash", "timestamp": "1784304757", "to_ids": true, "type": "vhash", "uuid": "335a34a3-d43f-493f-b403-94ea5b92f32b", "value": "156086666c056d15651550b2z212z867z7kz186z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T12:05:12+00:00", "last_seen": "2026-04-28T12:05:12+00:00", "object_relation": "filename", "timestamp": "1784304757", "to_ids": true, "type": "filename", "uuid": "278a0573-247d-42de-8c28-3bfe7fdbfbff", "value": "n-htcommp.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307772", "uuid": "3244f267-8eb8-4d1e-8642-6ea8e4d533e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "md5", "timestamp": "1784307772", "to_ids": true, "type": "md5", "uuid": "67aead2a-c0af-4c93-b69d-2a2a0f236dcc", "value": "cef60bdccea52e431c50fc626e3e0c05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "sha1", "timestamp": "1784305138", "to_ids": true, "type": "sha1", "uuid": "474dc348-a5f3-491e-9c16-c1469004aa2d", "value": "f1dd94408acc9d31f11b55e1e37ef1d5d630949c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "sha256", "timestamp": "1784305138", "to_ids": true, "type": "sha256", "uuid": "ee702482-e67b-414a-8fec-942bb78bc496", "value": "cbc9485db715e1b8cc384fe94b4cceadca4006cda8a5e28adc8848529cfafc93", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "text", "timestamp": "1784304778", "to_ids": false, "type": "text", "uuid": "53759361-38cf-4e20-a278-5ac623fbb85b", "value": "Type Description: Win32 DLL\nOriginal name: CAV3RN_APIEX_Module.dll\nMicrosoft: Trojan:MSIL/CavMant.DA!MTB\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2025-12-13T07:20:51+00:00\nFirst Submission: 2025-12-12T20:32:00+00:00\nLast Submission: 2025-12-13T07:20:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "creation-time", "timestamp": "1784304778", "to_ids": false, "type": "datetime", "uuid": "32f603c8-247b-4a97-bb33-4b83cd2e0d62", "value": "2025-09-28T10:14:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "ssdeep", "timestamp": "1784304778", "to_ids": true, "type": "ssdeep", "uuid": "8973c58d-8e20-41dd-a260-be8d2e0e763c", "value": "768:h6UP/zcMv2nWja/ZQzO22LA2F23R2BaSVmIbPqCUOvv1UHOOtSVhgNzhSk2P0E2J:h/P/cXff0NCz1ct+WNz01P2Nu1G" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304778", "to_ids": false, "type": "size-in-bytes", "uuid": "b2150e90-447c-4e26-a7ff-6319dcad30d8", "value": "84992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "vhash", "timestamp": "1784304778", "to_ids": true, "type": "vhash", "uuid": "274e4859-b3ef-4652-90a5-bd606d432d81", "value": "3840465d151511a08b4ab0068" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-12T20:32:00+00:00", "last_seen": "2025-12-13T07:20:51+00:00", "object_relation": "filename", "timestamp": "1784304778", "to_ids": true, "type": "filename", "uuid": "70b748bb-d2a0-4ca9-8fe0-d7b29bec05eb", "value": "CAV3RN_APIEX_Module.dll" } ] } ] } }