{
  "Event": {
    "analysis": "1",
    "date": "2026-05-20",
    "extends_uuid": "",
    "info": "[Threat Intel] Infostealer Campaign Using Trading App as Lure",
    "protected": false,
    "publish_timestamp": "1780284555",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780284554",
    "uuid": "08b137bc-104f-4dcc-a5ab-09ec9ce19b7b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#2084ce",
        "local": false,
        "name": "misp-galaxy:producer=\"Hybrid Analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#3bc6ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Code Repository - T1567.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#07a4a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#16ca73",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Location Discovery - T1614\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418869",
        "to_ids": false,
        "type": "link",
        "uuid": "5854f546-0ede-424d-ba76-360c4d4857ea",
        "value": "https://hybrid-analysis.blogspot.com/2026/05/velvet-chollima-infostealer-campaign.html?m=1"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418869",
        "to_ids": false,
        "type": "text",
        "uuid": "934120e1-67ea-422b-a779-94bfe4f05cee",
        "value": "A sophisticated infostealer operation was discovered masquerading as a cryptocurrency trading application called Tralert FX. The malicious MSI installer achieved only 3/52 AV detections by using a valid EV code signing certificate from a likely front company, AgilusTech LLC. The campaign has been active since June 2025, utilizing a three-module malware kit that includes system reconnaissance, keylogging, and browser credential theft capabilities. Stolen data is exfiltrated through five GitLab repositories via automated git commits on 30-minute cycles. Hardcoded credentials exposed the entire backend infrastructure, revealing over 4,100 commits, 90+ compromised hosts, and ongoing victim compromise. The operation demonstrates clear financial motivation with focus on cryptocurrency traders for account takeover. Three ProtonMail-linked GitLab accounts operate the infrastructure, assessed as a single operator or small team. The final payload is MoonPeak, a custom variant of XenoRAT."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418869",
        "to_ids": false,
        "type": "text",
        "uuid": "38cd4dbe-8660-42e2-b725-7e3210417a84",
        "value": "Name: Infostealer Campaign Using Trading App as Lure\nAuthor: AlienVault\nAdversary: Kimsuky\nTags: [\"infostealer\", \"cryptocurrency\", \"trading app lure\", \"GitLab exfiltration\", \"MoonPeak\", \"XenoRAT\", \"code signing abuse\", \"DPRK-nexus\"]\nTgtd countries: []\nMlwr families: [\"MoonPeak\", \"XenoRAT\"]\nAttack_ids: [\"T1566\", \"T1204\", \"T1036\", \"T1553.002\", \"T1547.001\", \"T1053.005\", \"T1059.001\", \"T1027\", \"T1105\", \"T1082\", \"T1012\", \"T1518.001\", \"T1056.001\", \"T1555.003\", \"T1567.001\", \"T1071.001\", \"T1132\", \"T1497\", \"T1497.001\", \"T1614\"]\nIndustries: [\"Finance\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418869",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "356582e2-1935-4898-b112-550cf1dacd0a",
        "value": "Kimsuky"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280089",
        "to_ids": true,
        "type": "domain",
        "uuid": "d1df4642-a4b4-46e3-b2c5-53501dd5d696",
        "value": "tralert.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280110",
        "to_ids": true,
        "type": "domain",
        "uuid": "29dafc6c-940c-44d0-b34c-15f05b20e7fa",
        "value": "tralert7.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280131",
        "to_ids": true,
        "type": "domain",
        "uuid": "4bdb3aa9-50ab-4971-b457-0fcbfcfc6684",
        "value": "talert.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280153",
        "to_ids": true,
        "type": "domain",
        "uuid": "08aad7e4-ae31-457c-baa0-2e7577bdaaef",
        "value": "endava.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280174",
        "to_ids": true,
        "type": "domain",
        "uuid": "2881583a-ab2d-4005-ab87-69b2530e569f",
        "value": "talert.site",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280196",
        "to_ids": true,
        "type": "domain",
        "uuid": "135fe32d-34cd-435f-9fd1-6c426d0becd5",
        "value": "talert.space",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280220",
        "to_ids": true,
        "type": "domain",
        "uuid": "0c8ffbcb-2932-4ea2-96ab-806d68c42952",
        "value": "talert.store",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280241",
        "to_ids": true,
        "type": "domain",
        "uuid": "b463fe16-4e30-4264-b92a-fddea81a196d",
        "value": "tralert.site",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280263",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa5b1c62-1fad-4ecb-9854-fc774d6144c2",
        "value": "tralert.store",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280284",
        "to_ids": true,
        "type": "domain",
        "uuid": "eef5f200-2e58-4219-baf6-d74dfa4c6641",
        "value": "trumpalert.store",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280306",
        "to_ids": true,
        "type": "domain",
        "uuid": "6ab5b3dd-37bc-4e9d-8d31-9d9ecbec5b44",
        "value": "why-db-sometimes-fails.md",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780280327",
        "uuid": "57dfeed7-b0c7-4e68-a104-7963b27036c8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780280327",
            "to_ids": true,
            "type": "md5",
            "uuid": "e087213a-4cad-441a-bd5c-6cf46974b79d",
            "value": "f10d35fedb6aa986cef4c113edfdef26",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197856",
            "to_ids": true,
            "type": "sha1",
            "uuid": "00cc075f-31d4-48d9-8276-6193f48e5797",
            "value": "ed02996ba97457166406d1d3230ef177fec67913",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197857",
            "to_ids": true,
            "type": "sha256",
            "uuid": "efdb4487-aa00-4d06-89a9-ca01c4496120",
            "value": "384255ba8bea8997dce5a6a9c4b4352279343000821128342e6960dbcc14bbe0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197501",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c03f2a9f-bbdd-4089-9cef-d872eeb31008",
            "value": "1572864:iA+HvRH7H+pczQA4to7OMOegv2AVXVQC0eda63Arzrg2TQpD2bnI3G4zdlnk0eW:5KHuc0AFOFOAHv1dSLapiyFdlnkk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197501",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f61e5a46-b636-4875-a237-33d638ee3e93",
            "value": "106598400"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197501",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f8d9af9e-68fd-4e6c-a36d-190f5c203fd0",
            "value": "7aafbb544e903136cfc63dcb5e1d76f6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197501",
            "to_ids": true,
            "type": "filename",
            "uuid": "1b19615f-42d0-4b1b-aa53-eef3aefe1393",
            "value": "Setup.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197501",
            "to_ids": false,
            "type": "text",
            "uuid": "91386c27-5d86-4a1f-96b3-b70293cb399a",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:9/61\nFirst Submission:2026-03-16T05:15:52.000000+00:00\nLast Submission:2026-03-16T14:58:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780280348",
        "uuid": "32c297f5-259c-443d-aac0-2776934a4bcc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780280348",
            "to_ids": true,
            "type": "md5",
            "uuid": "a92f8d17-02dd-4604-8b79-193c1bafc1e9",
            "value": "8bcfedccf028a08dafd34a01b036799f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197858",
            "to_ids": true,
            "type": "sha1",
            "uuid": "005e1121-9476-4bb6-80d7-1faeca2a2538",
            "value": "61623817b5bf4b0204bb94ffc7b5d59627224709",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197858",
            "to_ids": true,
            "type": "sha256",
            "uuid": "27b280da-78cf-49fb-ba32-d2dd60d25c88",
            "value": "3c356065e32ac8cbc6ec330581c7c343bf2d5567695f3a015a0ae95908a7ed6b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197523",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9875caea-195c-4def-a7ee-28885dc8a6fd",
            "value": "3145728:Op/NMru2YnDNDfkWpOOd5eGFg5WFt7XaqhLwsGz/2:GNsufRDfkWbDlC58tWqKC"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197523",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bf63f4e6-4db6-45c7-85f7-b650d3fe33ef",
            "value": "105357312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197523",
            "to_ids": true,
            "type": "vhash",
            "uuid": "df92c770-1004-4be8-bd94-8417d516e4a5",
            "value": "7aafbb544e903136cfc63dcb5e1d76f6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197524",
            "to_ids": true,
            "type": "filename",
            "uuid": "5c8b6045-0f96-4094-b687-a99afe85823a",
            "value": "tralert.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197524",
            "to_ids": false,
            "type": "text",
            "uuid": "6a3b5fad-b4f1-4fba-9162-2fe5b39dee6f",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:14/62\nFirst Submission:2026-01-07T01:46:50.000000+00:00\nLast Submission:2026-01-07T01:46:50.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780280369",
        "uuid": "1f644e31-eccb-4411-a8bc-286e3624dec1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780280369",
            "to_ids": true,
            "type": "md5",
            "uuid": "64696538-a5ee-4621-9393-64fb717f97c2",
            "value": "666da559f02a9b217a4c826b17923c0c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197859",
            "to_ids": true,
            "type": "sha1",
            "uuid": "37c4f2e4-7812-4ad9-bc56-793f25967b88",
            "value": "692b542e877af215c17e63ef61bbd0aaf927c7ad",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197859",
            "to_ids": true,
            "type": "sha256",
            "uuid": "beaef3bf-a84d-4afa-aa60-87520a0a15f5",
            "value": "528b004407d32bbc6299540a7a9fd98a3037070d34b56f14813aaaa29820b13d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197545",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f0e6259a-cdd3-428e-a27c-8132b73b1f5b",
            "value": "1572864:IA+HvRH7H+pczQA4to7OMOegv2AVXVQC0eda63Arzrg2TQ3QBRsbnI3GtEqeUZH0:/KHuc0AFOFOAHv1dSLas0yf8ph2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197545",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2a4a0883-201d-451f-986f-cb5b34a367a1",
            "value": "106586112"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197545",
            "to_ids": true,
            "type": "vhash",
            "uuid": "38bf96b5-24be-41d6-b012-6f5d0dd02aa5",
            "value": "7aafbb544e903136cfc63dcb5e1d76f6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197545",
            "to_ids": true,
            "type": "filename",
            "uuid": "f4368075-84d7-4430-94cd-793a73631c40",
            "value": "tralert.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197545",
            "to_ids": false,
            "type": "text",
            "uuid": "c1a018ef-47da-45b8-810c-fbebd3a1a86b",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:12/62\nFirst Submission:2026-02-27T13:44:18.000000+00:00\nLast Submission:2026-02-27T13:44:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780280390",
        "uuid": "7f390108-f086-48c9-8aaa-642f89529257",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780280390",
            "to_ids": true,
            "type": "md5",
            "uuid": "3a7a6ed7-c599-408f-be7a-6b2d51c6d826",
            "value": "4794c3cca9a860c8500f51d430cf2392",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197861",
            "to_ids": true,
            "type": "sha1",
            "uuid": "15fa8e43-54cd-44f2-aff8-91b4be161a7a",
            "value": "8d7a4b14b7f86d9f1857d8f54ebeffaf8b78b7fe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197861",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a3a4b8d4-ff36-41f8-8a7f-f5c63ad1220c",
            "value": "eaba341f94e700ff470e7a8fb3fe596f601ff54a8415103fa102520ec4bbd5e9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197567",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0041c452-7bb0-4a0c-9ff6-829794e8bb4f",
            "value": "3145728:4B/NMrueYHDND3AmpG6J5e69g5Wttdf3/DMrukWHDND3MsvSwxve6jWrQHX/sGq1:INsuHRD3Am/3Jq5EtdDsu3RD3MsfJRCr"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197567",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b555d8a1-d904-4acf-bed7-dec7e24c748a",
            "value": "174858240"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197567",
            "to_ids": true,
            "type": "vhash",
            "uuid": "6c775a9a-8633-4cb6-a56e-dc7c37060b8e",
            "value": "7aafbb544e903136cfc63dcb5e1d76f6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197567",
            "to_ids": true,
            "type": "filename",
            "uuid": "46a31c0b-ac25-4415-ab03-a42f451c985a",
            "value": "tralert.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197567",
            "to_ids": false,
            "type": "text",
            "uuid": "ddca8ba3-3f9b-4336-944a-c2f5dae49945",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:13/61\nFirst Submission:2026-01-09T16:02:31.000000+00:00\nLast Submission:2026-02-10T20:38:30.000000+00:00"
          }
        ]
      }
    ]
  }
}