{
  "Event": {
    "analysis": "1",
    "date": "2026-06-19",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation Poisson \u2013 Analyzing a Cybercriminal\u2019s Entire Operation",
    "protected": false,
    "publish_timestamp": "1782443596",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782443595",
    "uuid": "0b677310-bb00-414b-b684-3b3c416a85e6",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d74cce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#370063",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Automotive\"",
        "relationship_type": ""
      },
      {
        "colour": "#f6cea1",
        "local": false,
        "name": "misp-galaxy:country=\"france\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781924406",
        "to_ids": false,
        "type": "link",
        "uuid": "dabe7cd6-8176-4407-a326-e965276a6cd2",
        "value": "https://www.catonetworks.com/blog/cato-ctrl-operation-poisson-analyzing-a-cybercriminals-entire-operation/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781924406",
        "to_ids": false,
        "type": "text",
        "uuid": "883d3cde-184d-420a-aafc-a27e0563f4f2",
        "value": "A comprehensive analysis of 339 commands issued by a French-speaking threat actor nicknamed 'Poisson' over 33 days, targeting a French automotive small business and four French individuals. The attacker utilized a multi-stage fileless attack deploying a 70-line Python keylogger to harvest banking and email credentials. The operation leveraged free-tier infrastructure including Havoc C2 framework, Backblaze B2 storage, and DuckDNS. Most significantly, the attacker installed OpenSSH and Tailscale VPN on victim machines, creating persistent access that survived C2 server takedown. When the C2 went offline for 18 days, the attacker's access remained intact through the VPN mesh, demonstrating that VPN-mesh-based persistence is actively used in real-world intrusions and that traditional C2 takedown is insufficient for remediation."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781924406",
        "to_ids": false,
        "type": "text",
        "uuid": "05c65cc0-e6b1-44fb-930a-bd1b5f6f25b9",
        "value": "Name: Operation Poisson \u2013 Analyzing a Cybercriminal\u2019s Entire Operation\nAuthor: AlienVault\nAdversary: Poisson\nTags: [\"tailscale\", \"rustdesk\", \"poisson\", \"credential-theft\", \"france\", \"keylogger\", \"fileless-attack\", \"openssh\", \"havoc\", \"havoc-c2\", \"vpn-mesh-persistence\"]\nTgtd countries: [\"France\"]\nMlwr families: [\"Havoc - S1229\", \"RustDesk\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1056.001\", \"T1548.002\", \"T1114\", \"T1021.004\", \"T1140\", \"T1055\", \"T1090\", \"T1102\", \"T1552.001\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1027\", \"T1573\", \"T1070.004\", \"T1071.001\", \"T1059.005\", \"T1021.001\"]\nIndustries: [\"Automotive\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354712",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "459e54c2-e86d-4ba2-97fc-d501e9cbc017",
        "value": "Poisson",
        "Tag": [
          {
            "colour": "#f6cea1",
            "local": false,
            "name": "misp-galaxy:country=\"france\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442473",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "84ae6013-2ade-4b6d-a404-f1d48794572b",
        "value": "217.154.162.45",
        "Tag": [
          {
            "colour": "#f3fcab",
            "local": false,
            "name": "asn:asn=\"8560\"",
            "relationship_type": ""
          },
          {
            "colour": "#97689f",
            "local": false,
            "name": "asn:as-owner=\"IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE.\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442494",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8d6ea237-dead-405e-a927-28cb50cf52f9",
        "value": "217.154.217.139",
        "Tag": [
          {
            "colour": "#f3fcab",
            "local": false,
            "name": "asn:asn=\"8560\"",
            "relationship_type": ""
          },
          {
            "colour": "#97689f",
            "local": false,
            "name": "asn:as-owner=\"IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE.\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442515",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1ca4cba8-868c-45a4-822a-1326379cf25e",
        "value": "wawsenti.duckdns.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367237",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e5bf6b23-f5fb-4acc-97b9-92c30de2b00d",
        "value": "0378a5ef51b008aa2d6b76bd44a0bf061339bc3b737a188ec82029444d4d18fe",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367238",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0880c7f7-2655-4636-9797-342a937269fe",
        "value": "c79091ceae7cd592fc08e4854cda7c1182af762b6b126371cc604debdc995fc7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367239",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5c5d9203-2192-4864-9815-9f5da2ffe400",
        "value": "f06e7e1a4363a01ba2a4fee2e28abdd623abf4194bda373f23ff0e151b5c2b45",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442537",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5f0e1629-ccc0-4075-97f6-2fb97987017b",
        "value": "pois43.s3.eu-central-003.backblazeb2.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442558",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a6ac0ec3-3c92-4865-ad26-772f15bc778a",
        "value": "sentiwaw.s3.eu-central-003.backblazeb2.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442580",
        "to_ids": true,
        "type": "hostname",
        "uuid": "db4f7e75-584f-4205-ace7-ec60994a8746",
        "value": "w456w5.s3.eu-central-003.backblazeb2.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442601",
        "uuid": "710231a3-fabb-45d5-93c9-3c14e23c2a64",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442601",
            "to_ids": true,
            "type": "md5",
            "uuid": "5a37111a-86b6-4c82-b15c-eef492c03a30",
            "value": "c9947acb93de28ee52f8372beec7946c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367231",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d63837d0-22c2-40b6-b97e-9281f1380809",
            "value": "61a9de1d00be190e2eee0519e32e1318b4411687",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367231",
            "to_ids": true,
            "type": "sha256",
            "uuid": "89b5b454-d5d2-4643-8fbf-e68e26b13cff",
            "value": "1f00fd604bb18bbe3081f9ce8d741c4029d2a2125eb8888ac4e0d955938059d6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366835",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c0890586-f583-4f7c-9464-b168b3f5b58c",
            "value": "393216:HMxK2cKCtAySTxqglLrdWzNxi6QpDHOpvFpXmwj0w7XGO3hZBX/u:sGSTgydmNKHOpv9Aw7V3zpu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366835",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "56f1c0f6-82d8-4068-9821-db6d4369ed3c",
            "value": "19983578"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366835",
            "to_ids": true,
            "type": "vhash",
            "uuid": "493d4f8f-0b46-4875-9e19-0c5bf968b438",
            "value": "3bf9d6e36025a7c24fd4860d30b7edb7"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366835",
            "to_ids": true,
            "type": "filename",
            "uuid": "ae072f79-5fd3-4275-af2b-91db877899b7",
            "value": "KeyL.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366835",
            "to_ids": false,
            "type": "text",
            "uuid": "d5f83eaf-7c8b-4351-8f58-1d5703c29271",
            "value": "Type Description: Python Wheel package\nMicrosoft: None\nVT Total Detection:11/68\nFirst Submission:2026-03-30T15:01:45.000000+00:00\nLast Submission:2026-03-30T15:01:45.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442622",
        "uuid": "1ce33304-0b08-4679-9208-37fbeb1a1526",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442622",
            "to_ids": true,
            "type": "md5",
            "uuid": "33a12068-6a2d-49bd-b64f-1299cb5ac0fe",
            "value": "c6311521d285c115484a9e7336fb3efb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367233",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bffed93e-6471-4dc8-bf96-59170aaef392",
            "value": "dd3416e68c01fcd028da66aec208651514e3fc53",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367233",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5dcc4e4e-e49f-4262-a250-9431cb402e5e",
            "value": "291cb1fd0f2709b4457447cbb87adacf5c36c1bcb0f8754524024d44174bb195",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366857",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "906e9811-8a97-476a-ae62-caac8e77ecfe",
            "value": "24:UfrLbJwZD+qqAQd7Tzlr1F0KC2IaTn2Lw1/t/haRoGDUyeFmLyMsf9o7mWmdWFh7:UT0vQ5BY3CT11Z3+Uy3LQ8mChqtUbiZ6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366857",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "28d50cb5-3eb6-4c8e-acad-375da359e918",
            "value": "1531"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366857",
            "to_ids": true,
            "type": "vhash",
            "uuid": "45eba3ea-5ba2-42c2-9b44-05b6e3ac5c54",
            "value": "0ac0e347b053115ad9dc536f85055797"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366857",
            "to_ids": true,
            "type": "filename",
            "uuid": "2c1d4a2b-22d8-4006-a042-131b7d67fab8",
            "value": "RevS.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366857",
            "to_ids": false,
            "type": "text",
            "uuid": "a70b1962-b3a2-4ff3-b965-06d442e4ecfe",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:19/60\nFirst Submission:2026-05-25T12:16:49.000000+00:00\nLast Submission:2026-05-25T12:16:49.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442643",
        "uuid": "0a5f6c3a-c30c-4551-9cbd-a833d68a07f6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442643",
            "to_ids": true,
            "type": "md5",
            "uuid": "13f443f3-1040-40ef-ba50-fae3ac084e05",
            "value": "7b875e90d2ab6f87beb398d778be1d26",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367234",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d3e455f8-c004-46ff-aa37-4082b61f1692",
            "value": "aef959e73f64a068a466ce23d8bdd6ea7499f331",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367234",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d8d24762-d718-46d4-8152-7cf0924e0c51",
            "value": "3b7642b0f84e83a36334c608655c6cb7aae774839a6a3488526b853d89830a60",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366878",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "156ab7c8-6978-4d37-8f13-1baf0db9ee08",
            "value": "6144:lFfe8CzKB8viN7+FgjBFdO3FRuYKlI7JNJZw2ZLuN9fcBJsMgEuMV/6FRewZJrEa:l9kc+mg3uQL89UsR474udxPAP7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366878",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "39465298-7af9-4247-856c-0619976d23ce",
            "value": "3101184"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366878",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f01973a3-daa0-4489-b4bb-3e211bc59774",
            "value": "3360361515131z11z10"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366878",
            "to_ids": true,
            "type": "filename",
            "uuid": "05123275-0c39-4bd9-97ea-7af6a19ae8e2",
            "value": "senti.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366878",
            "to_ids": false,
            "type": "text",
            "uuid": "be9bc16c-38b2-4650-b7f1-6672cae5fa17",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:41/70\nFirst Submission:2026-05-25T12:14:41.000000+00:00\nLast Submission:2026-05-25T12:14:41.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442664",
        "uuid": "d09ae3b8-d0c4-4b82-91bb-f33036e7e769",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442664",
            "to_ids": true,
            "type": "md5",
            "uuid": "7f40d4f5-3b2b-48c5-8401-1260e2241724",
            "value": "610669b9be49541d230588b1d611697c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367235",
            "to_ids": true,
            "type": "sha1",
            "uuid": "939614de-4e7c-4609-9a42-15a21749d31c",
            "value": "6a0b10ad4ce59c3bbfd8de399b83c46989c71aca",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367236",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c6f2a418-adae-4448-a079-1ae8b6818f9b",
            "value": "aa7ea19e34567458b4ee66a7cd274181764984bf32123f756a7fdc64d5857b31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366900",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4db0954b-1475-4a76-973e-0dae718a4f7d",
            "value": "24:ZqZ2z2xHal2nYEF8rGzefKS+KMzdIWDrJlFexR60HRzyZc7AzLw1++gP6bPwf:eucHO83MhlMRRDzwK0HRWfw1YP6M"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366900",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e0c8ba53-183e-4f79-b87e-79ddba4dddf8",
            "value": "1125"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366900",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2d2b72b3-d736-4318-932a-03fa7dbc042e",
            "value": "5894add168c06e72264f61e50702f6fe"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366900",
            "to_ids": true,
            "type": "filename",
            "uuid": "c12315cf-20f0-4ffe-b818-7c771ad34535",
            "value": "sys.vbs"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366900",
            "to_ids": false,
            "type": "text",
            "uuid": "a36188d9-4311-4fcb-94fe-34602019c8dc",
            "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:14/59\nFirst Submission:2026-05-25T12:07:01.000000+00:00\nLast Submission:2026-05-25T12:07:01.000000+00:00"
          }
        ]
      }
    ]
  }
}