{
  "Event": {
    "analysis": "1",
    "date": "2026-07-09",
    "extends_uuid": "",
    "info": "[Threat Intel] Fake Banking Rewards, Telegram Delivery and Albiriox: Anatomy of an Android Malware Campaign",
    "protected": false,
    "publish_timestamp": "1784349348",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784349347",
    "uuid": "0daf67dc-22e6-40ff-b2e5-a7657559104f",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#c9dbdd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#4cea11",
        "local": false,
        "name": "misp-galaxy:target-information=\"Italy\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Android\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783681218",
        "to_ids": false,
        "type": "link",
        "uuid": "3700db9b-d2de-4b46-97ed-211077d6fb31",
        "value": "https://www.d3lab.net/fake-banking-rewards-telegram-delivery-and-albiriox-anatomy-of-an-android-malware-campaign/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783681218",
        "to_ids": false,
        "type": "text",
        "uuid": "f454024d-e664-4c2e-8b8d-8d8a890518c9",
        "value": "A malicious campaign was detected impersonating an Italian banking brand through a fraudulent domain offering fake financial rewards for installing a mobile application. Users are redirected to a Telegram bot that distributes a malicious Android APK outside official app stores. The APK functions as a dropper containing an embedded second-stage payload identified as Albiriox, an Android banking Remote Access Trojan. This payload exploits Accessibility services, implements overlay attacks, intercepts SMS messages, captures credentials, and enables remote device control through a custom TCP-based command-and-control protocol. The infrastructure uses domain impersonation and social engineering with financial incentives to distribute the malware. Communication occurs via raw TCP sockets to endpoints on ports 5555 and 5552, with JSON messages framed using big-endian length prefixes. Attribution to Albiriox is supported by protocol similarities, behavioral patterns, and comparison with known Albiriox samples."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783681218",
        "to_ids": false,
        "type": "text",
        "uuid": "8b959440-c6bd-4109-8f95-34772b7dd6bf",
        "value": "Name: Fake Banking Rewards, Telegram Delivery and Albiriox: Anatomy of an Android Malware Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"banking trojan\", \"overlay attacks\", \"sms interception\", \"android\", \"albiriox\", \"brand impersonation\", \"accessibility abuse\", \"telegram delivery\", \"italy\"]\nTgtd countries: [\"Italy\"]\nMlwr families: [\"Albiriox\"]\nAttack_ids: [\"T1608\", \"T1204\", \"T1566\"]\nIndustries: [\"Finance\"]"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344629",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5ec35d69-917c-47ad-a584-9913208a5a71",
        "value": "146c62f408b6d7db4c832a6b5f7bdacb1cff2c69121b9b2f7e80646c37910abd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344631",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5086c3d0-193b-4954-bc64-0f36f449483d",
        "value": "4b9a95ebf5e471d11443fa2f19b75595fc1fcf6be234024cc1d4a2255068c19b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344632",
        "to_ids": true,
        "type": "sha256",
        "uuid": "bc47dce6-215e-44cb-9791-8f9cd01420f3",
        "value": "e0fc365c042e708c8d04b5431238958586194cc4a8cbe069411a26dcfcc4e9b6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344633",
        "to_ids": true,
        "type": "sha256",
        "uuid": "46e7b0b2-dd4c-4447-bf30-d5e2448937b6",
        "value": "efc81267da3ad48cc779e9aed8f9232504ed7c85abf3958a87ba2ae68056ae23",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344634",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d5f9c818-3ac9-40dc-a930-116a1fdddbd1",
        "value": "fb43c4191c40f159167a98a4ac20bf23ae66a8ec27a919f703e953933e22a266",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784349218",
        "to_ids": true,
        "type": "url",
        "uuid": "28e30393-54d4-4eb3-8c3c-a643046efb2d",
        "value": "http://unicredit-tme.shop/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784349239",
        "to_ids": true,
        "type": "domain",
        "uuid": "8a07274f-e60c-4afa-a8dc-e72a8ebd1c94",
        "value": "unicredit-tme.shop",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-09T08:52:37+00:00",
        "last_seen": "2026-07-09T08:52:37+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784349261",
        "uuid": "385f0540-6ace-41e9-a244-9f02272cceaa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "md5",
            "timestamp": "1784349261",
            "to_ids": true,
            "type": "md5",
            "uuid": "40ad1460-7d8c-432d-b9eb-db59a4c103d1",
            "value": "6aa665d2f33f03a549c14edec772cf2c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "sha1",
            "timestamp": "1784344627",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f70181e3-8d8a-4363-a440-ca8ccc425d60",
            "value": "81fec7d1b670cc15cb88b072fd110588d7018e62",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "sha256",
            "timestamp": "1784344627",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7f83ba24-2e2a-4fe2-a755-31984aed49df",
            "value": "1e99972b1d84b131eb55a6b49f64871c5c0c6a1bb2a099a84313001b69dc53e8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "text",
            "timestamp": "1784343570",
            "to_ids": false,
            "type": "text",
            "uuid": "fccbd41e-bc61-438e-b414-5bf5813e1105",
            "value": "Type Description: Android\nMicrosoft: None\nClamAV: None\nVT Total Detection: 9/74\nFirst Submission: 2026-07-09T08:52:37+00:00\nLast Submission: 2026-07-09T08:52:37+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784343570",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "220541fc-7848-488e-88f5-f05e37cb873c",
            "value": "49152:erIm83kLn0uBDBogUzya12VAiijEVCXZj4g2cc5gbk3oTwryVrl2zak2tkg/Dafc:YskvVohn121VVOmoTwryeE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784343570",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7c396db2-982e-491d-a205-dd01bacde304",
            "value": "3273119"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-09T08:52:37+00:00",
            "last_seen": "2026-07-09T08:52:37+00:00",
            "object_relation": "filename",
            "timestamp": "1784343570",
            "to_ids": true,
            "type": "filename",
            "uuid": "4731c2cc-7eba-4d29-9d96-adf8600b7804",
            "value": "payload_stage2.apk"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-09T08:31:06+00:00",
        "last_seen": "2026-07-09T08:31:06+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784349282",
        "uuid": "9813fea4-e5e0-4303-812f-5ca8cdf8ad8d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "md5",
            "timestamp": "1784349282",
            "to_ids": true,
            "type": "md5",
            "uuid": "29510fad-2a73-4f8e-bfc9-6cb5beed5de6",
            "value": "f7e4bbf9cb965f6ec677712ab7eb31f3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "sha1",
            "timestamp": "1784344628",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2a73e247-0e5d-4346-b8ab-1032e79e72e5",
            "value": "0e4032c7916d800dc8a29bc4ddd53d225262146c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "sha256",
            "timestamp": "1784344628",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9b04690a-20e2-4307-b055-684fe44706f4",
            "value": "206fdbe992b44ebd6720c49c79a5da3bdcb48d0d799a0ff3458323caac3cc490",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "text",
            "timestamp": "1784343612",
            "to_ids": false,
            "type": "text",
            "uuid": "50469c64-1e70-453c-a3a0-5d5e864440f8",
            "value": "Type Description: Android\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-07-09T08:31:06+00:00\nLast Submission: 2026-07-09T08:31:06+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784343612",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ff4e0342-fde4-4bc0-8f8e-48030ce446f1",
            "value": "49152:DTy3XObCfv0lRiG1SI0GB6JhjRBUZrZN7IhVkqiN9LiAN7PZEmG1y9s8CcuS:DTDbCfslcdJhjROZv7YVkt9LieGcD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784343612",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "82795828-57ee-43cb-91d8-91673c760e9f",
            "value": "2812056"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-09T08:31:06+00:00",
            "last_seen": "2026-07-09T08:31:06+00:00",
            "object_relation": "filename",
            "timestamp": "1784343612",
            "to_ids": true,
            "type": "filename",
            "uuid": "994d57f3-e8ff-4dbe-aac8-030cd5b2133b",
            "value": "UniCredit.apk"
          }
        ]
      }
    ]
  }
}