{
  "Event": {
    "analysis": "1",
    "date": "2026-07-15",
    "extends_uuid": "",
    "info": "[Threat Intel] Inside an IoT Botnet Framework With LLM-Assisted Development",
    "protected": false,
    "publish_timestamp": "1784553535",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784553535",
    "uuid": "0f6672ec-54bd-40f9-b8d6-cc87aa1fc6cd",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0afe32",
        "local": false,
        "name": "misp-galaxy:producer=\"Palo Alto\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#790faf",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Direct Network Flood - T1498.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#b2a633",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#8f36b9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Reflection Amplification - T1498.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#5780f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Default Accounts - T1078.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#474886",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Linker Hijacking - T1574.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0fe1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#237502",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Transfer Protocols - T1071.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003f",
        "local": false,
        "name": "rectifyq:sub-category=\"tool-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"Gafgyt\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"Mirai\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"aisuru\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"tsunami\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"WordPress\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"apache\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"digitalocean\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"github\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "link",
        "uuid": "7007417f-5b90-4b95-8d34-2389b62bc56d",
        "value": "https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "text",
        "uuid": "871d410a-b8b1-4f9f-b00d-ac973d8c93f7",
        "value": "A previously undocumented modular IoT botnet framework has been identified with code partially generated using large language models. The framework consists of C-based bot agents compiled for 17 architectures, a Go-based command-and-control server with DDoS-for-hire panel, and custom exploit capabilities. Bot agents brute-force Telnet access using 1,496 credential pairs and target over 30 IoT device families. While core infection mechanisms function properly, several features are broken due to LLM-generated bugs that were shipped without manual review. The framework includes multiple fallback C2 mechanisms including domain generation algorithms, peer-to-peer gossip, IRC, and DNS TXT queries. Infrastructure analysis links this operation to the Keksec ecosystem through shared dropper servers. Development timeline spans from January 2025 to April 2026, with active C2 infrastructure observed since March 2026."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "text",
        "uuid": "3bdbe3e6-9305-4204-b66c-1bf83210d1bb",
        "value": "Name: Inside an IoT Botnet Framework With LLM-Assisted Development\nAuthor: AlienVault\nAdversary: \nTags: [\"llm-generated code\", \"gafgyt\", \"ddos-for-hire\", \"telnet brute-force\", \"tsunami\", \"iot botnet\", \"aisuru\", \"kaitori\", \"tuxbot v3\", \"mhddos\", \"keksec ecosystem\"]\nTgtd countries: []\nMlwr families: [\"TuxBot v3 Evolution\", \"AISURU\", \"Kaitori\", \"Tsunami\", \"Mirai\", \"Gafgyt\", \"MHDDoS\"]\nAttack_ids: [\"T1110.001\", \"T1498.001\", \"T1568.002\", \"T1071.004\", \"T1489\", \"T1497.001\", \"T1053.003\", \"T1082\", \"T1498.002\", \"T1140\", \"T1078.001\", \"T1574.006\", \"T1083\", \"T1036.004\", \"T1057\", \"T1071.002\", \"T1090.003\", \"T1059.004\", \"T1027\", \"T1071.001\", \"T1543.002\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "d7179622-aad1-4d77-b32f-51b56b727914",
        "value": "CVE-2014-2321"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "c3a04b16-1885-4946-aefa-29eb3c9f8aa4",
        "value": "CVE-2014-8361"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "d506277b-934c-4a09-bc09-a739317c47c7",
        "value": "CVE-2017-17215"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "2e4ddd88-4858-4583-acca-6c0b72be07c6",
        "value": "CVE-2018-10561"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "e9457599-e7db-44d7-b6a7-c1a8be0ec378",
        "value": "CVE-2018-10562"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553170",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "faf59493-d14a-438e-ad44-70675f6baa94",
        "value": "185.10.68.127",
        "Tag": [
          {
            "colour": "#5d4ed6",
            "local": false,
            "name": "asn:asn=\"200651\"",
            "relationship_type": ""
          },
          {
            "colour": "#fa141a",
            "local": false,
            "name": "asn:as-owner=\"FLOKINET\"",
            "relationship_type": ""
          },
          {
            "colour": "#19ad3d",
            "local": false,
            "name": "asn:as-country=\"IS\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"iceland\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "26dfb9c3-58dc-4fac-980b-ac0918f1d977",
        "value": "CVE-2018-20062"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "d1374ce3-ade2-44e5-99c6-a9208e4b67fd",
        "value": "CVE-2007-3010"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "9eccaa17-4b27-457b-8ef7-2a0afc007c19",
        "value": "CVE-2017-18377"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "1337d831-5f07-44be-8294-75a7851eb12e",
        "value": "CVE-2013-7471"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "b7e40993-0b22-4fba-8357-26948c46ffcc",
        "value": "CVE-2020-8515"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553191",
        "to_ids": true,
        "type": "domain",
        "uuid": "88180053-ebba-437b-b334-e4239e6a0f22",
        "value": "jetross.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "ebe9c214-be8b-4ba9-8a75-ea6b8964fe52",
        "value": "CVE-2021-25646"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "3d453dda-9518-4023-b075-bcbe988af87f",
        "value": "CVE-2016-11021"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "beb649c6-f7e4-4815-88be-1e37739f8e25",
        "value": "CVE-2022-22965"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "fe9e09e9-24a8-4b80-b245-8045d15dd822",
        "value": "CVE-2021-4045"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "107edf32-183c-453b-b9ba-046e733caa9a",
        "value": "CVE-2022-22947"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170867",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "5764f2bc-7dc3-4a6f-b1fc-52553d1101fd",
        "value": "CVE-2020-17456"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "61d2d117-dfbe-46ef-a482-adc941f2878b",
        "value": "CVE-2022-1388"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "c50ba5b3-4d8b-4908-9980-3940ee1ff414",
        "value": "CVE-2022-30525"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "c8ede3f6-0424-4bd5-9f47-53d9b1d87679",
        "value": "CVE-2022-44877"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "0041f2ac-933f-486c-b9de-74e373063022",
        "value": "CVE-2023-1389"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "6c790799-e8dd-453e-811d-b65b1beda4c5",
        "value": "CVE-2023-39780"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553212",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1aa9b51e-8fe9-44df-bee4-fcdeed635646",
        "value": "194.46.59.169",
        "Tag": [
          {
            "colour": "#3808e9",
            "local": false,
            "name": "asn:asn=\"204044\"",
            "relationship_type": ""
          },
          {
            "colour": "#545d46",
            "local": false,
            "name": "asn:as-owner=\"ONLYSERVERS Dedicated Server Hosting Provider\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "a846ab6f-aee4-49e5-a2b5-64f412f7b911",
        "value": "CVE-2025-34037"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553233",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0a2def4f-c081-4042-b578-02d82bbd6384",
        "value": "154.6.197.43",
        "Tag": [
          {
            "colour": "#051025",
            "local": false,
            "name": "asn:asn=\"395880\"",
            "relationship_type": ""
          },
          {
            "colour": "#387220",
            "local": false,
            "name": "asn:as-owner=\"BCL-AS1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "b8555d11-42bf-42bb-b9f9-e60bc4b19f62",
        "value": "CVE-2026-5815"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553255",
        "to_ids": true,
        "type": "domain",
        "uuid": "3f7e8830-09af-48f0-ac7b-97221a98e54a",
        "value": "cfcybernews.eu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553276",
        "to_ids": true,
        "type": "domain",
        "uuid": "fdfd9f2e-ccca-4372-8d87-84e19aba7420",
        "value": "digikalas.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "2f7ebe3a-7e67-4770-8491-68a0b0ac634e",
        "value": "CVE-2007-5693"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784170868",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "b3798d90-6725-4015-a413-0daa205ad19b",
        "value": "CVE-2025-34117"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553297",
        "to_ids": true,
        "type": "hostname",
        "uuid": "eb0ee17c-8d67-4e5b-a10d-9d26630e869b",
        "value": "newtuxdev.sevielw.digikalas.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463743",
        "to_ids": true,
        "type": "sha1",
        "uuid": "11993d59-aedc-4ea9-bfd0-b88e4e3ceff0",
        "value": "2774a5f5991657eb9b0062cd3da0391c9bad2643",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463744",
        "to_ids": true,
        "type": "sha1",
        "uuid": "0360f26e-3d23-405c-8d29-9b2d133821bc",
        "value": "304e14a138b92135aad27bb37f4e9db440401ec2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463745",
        "to_ids": true,
        "type": "sha1",
        "uuid": "ceabcf5d-97df-43dd-86d6-2cd98eb29b15",
        "value": "4cba585d9f208bd712b28f867f908e503ccc9cfe",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463746",
        "to_ids": true,
        "type": "sha1",
        "uuid": "250e7d18-65f6-4f17-a8f5-c0fcf263c6d5",
        "value": "4e1483737f769e1cee80fa4d7a056a5d8e3b537e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463747",
        "to_ids": true,
        "type": "sha1",
        "uuid": "04e0da11-6c75-48b2-8413-eae3d9b38b03",
        "value": "64af594c7f91793813e3d769e63816b143102396",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463748",
        "to_ids": true,
        "type": "sha1",
        "uuid": "816d730e-dd62-4a2a-b23e-89d98736b021",
        "value": "69dc276dde8efcb409411508da55d4cbe28d5600",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463749",
        "to_ids": true,
        "type": "sha1",
        "uuid": "2a7eee98-a4cc-4b7a-90f9-97a83e081a1e",
        "value": "74fba0bad93bbb0e1eedb196b6efe6af1c0bf23d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463750",
        "to_ids": true,
        "type": "sha1",
        "uuid": "6f912ebd-ffe9-4042-8906-b3883bf32f09",
        "value": "7ad840b1945cc346012987727ebcc062431965a4",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463751",
        "to_ids": true,
        "type": "sha1",
        "uuid": "ac145f15-64dc-478e-a7fd-33021a46f12b",
        "value": "81670f250f4b3492fd3e00920f9fe7395ecbf85c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463752",
        "to_ids": true,
        "type": "sha1",
        "uuid": "46fed333-fda8-4efe-82d6-82924b9867a3",
        "value": "877b804892ab218a53420b6dfbd0a2837368d0b5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463753",
        "to_ids": true,
        "type": "sha1",
        "uuid": "eea0673f-e29d-49d7-8244-1e2009964110",
        "value": "a70cea846442c18ad265f311b5ced29a4071771d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463754",
        "to_ids": true,
        "type": "sha1",
        "uuid": "92140696-a47f-45c4-acca-82a76c70ca3b",
        "value": "a8fd13f6b1bdfa87c0f466df69b7e81325b5dd15",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463754",
        "to_ids": true,
        "type": "sha1",
        "uuid": "b3d84448-8dd9-474f-8d52-9dcdd36383ff",
        "value": "adf267caab78a74c4b4dfabe7b578b0a4d639782",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463755",
        "to_ids": true,
        "type": "sha1",
        "uuid": "fe2cde86-079a-4ece-aeb0-67313962011c",
        "value": "b1cc41e2b9ddb11d0c9d03d319531fea9459cdae",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463757",
        "to_ids": true,
        "type": "sha1",
        "uuid": "b21eafc9-1c4c-4148-ad1a-81b2800e335b",
        "value": "b21cdc5e1b96c640a1d553ed518c49729e367823",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463758",
        "to_ids": true,
        "type": "sha1",
        "uuid": "deb2ea29-1b15-4e66-b306-81736fdb06fc",
        "value": "befb0e4d1cd7d2b4139b55f811993af2c8839e75",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463759",
        "to_ids": true,
        "type": "sha1",
        "uuid": "50c8baaf-6d50-4e1e-a5a1-80de6d41d25d",
        "value": "cd540bb31909440fd2bf773e6f1480f5b6f12400",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463760",
        "to_ids": true,
        "type": "sha1",
        "uuid": "8abb6164-9505-4c9f-a4bf-515c68621081",
        "value": "e0f8dd23e4fb0086feb42ea0a5dcef70d7b4d17c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463761",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1cc40261-a7d7-4f11-b8eb-14f5327f83cf",
        "value": "0f8bcca3ed65e980da2a1f90a767b7d543be32eeea3e9338d09d4d635a497988",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463762",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0b541a7b-75c3-41ff-ad68-1a129f27c741",
        "value": "146f6010f6ee082aab13e0148d39baefa77eaba4ff65817b511b08c2092bdfd2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463763",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ce8696ff-bcf0-45ef-ae4a-2608426dd72f",
        "value": "15c17dce89deccd5172285b2650de957918aa1157cde8e4633ae15dfe31f2711",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463764",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e12863cd-a8f2-4417-b7b4-0eb07b3cc0b5",
        "value": "246c97957651de568e61eba1abe572f0b0f960456209995d43d53a0d7cc494a1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463765",
        "to_ids": true,
        "type": "sha256",
        "uuid": "dcd9894f-b23b-476f-b153-cb94ac9ecdb8",
        "value": "2f2c3551762c03da126e45dca6fc2f997c63f0f1bfc21fd0ceed680ac6f083ce",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463766",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1cc5ba51-09fe-4303-bdc5-4af1c3323482",
        "value": "3ec016d637e4c9cd331edd2580a229621ad638e924a4aa29ac0342e9144ace19",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463767",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d04d5e7a-b2d4-49a4-8bde-e88480b73c12",
        "value": "511d3ffb4091cbcc94571d9fb3102e8cb424c6e187d01d53ff12078d54929bda",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463768",
        "to_ids": true,
        "type": "sha256",
        "uuid": "47ca0330-b47a-4c98-80cf-f8e9fd3242d8",
        "value": "6aa4034dc7a2858094ff4dc59af07d6fe31119591e41599bcc0f3d0b516ee734",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463770",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4ab4b2fd-6188-4b19-ae59-c34f96671e6c",
        "value": "6b7a8e0c96c2318e747f074f9a99d26738700769ac01bba692d19fc884847737",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463771",
        "to_ids": true,
        "type": "sha256",
        "uuid": "09ba8a70-715a-41c1-a518-5f92f558bee3",
        "value": "96b1f96efca3b9df2dea85678d60da27e3265b4a00e39e20e64b27bb985e1561",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463771",
        "to_ids": true,
        "type": "sha256",
        "uuid": "11d962db-d166-4555-9a50-51f220aab6c8",
        "value": "9cd5e7e3c8bad321ef6c3d47fe25b3b56e9487f703a7eeee52db4067e6bafe61",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463773",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1f9dedc5-a333-4c55-a626-3a88e3107889",
        "value": "a03b0d41f5ef03328150331ffa0ed970998883f7e0343d79b2d3b95330d8e7c1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463774",
        "to_ids": true,
        "type": "sha256",
        "uuid": "3ffc50b4-19cc-4bae-90c5-f213ac406271",
        "value": "a8d70d16509e227d8306be361bc37a3dc9fe34bf476f51e361e55e6d293c2b3f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463775",
        "to_ids": true,
        "type": "sha256",
        "uuid": "61b94fce-cc54-4cc4-853e-cb11e85a3919",
        "value": "bd6431fb06e4689142ef597cf00382e38ae20a5393a4d9277e45a3f5b3cbcff9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463776",
        "to_ids": true,
        "type": "sha256",
        "uuid": "074f6323-7470-4853-b415-d962fbc3d0c7",
        "value": "c7a36d6b8128c41f93a32413675401a10a2b5769b221bbaa8c5c309585b73ceb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463777",
        "to_ids": true,
        "type": "sha256",
        "uuid": "773f3d3b-b83a-499e-8ca7-b08a58f0a48d",
        "value": "e3a5296e762e9ee16010399666441d663beeea956382e97cca032a6a5ad06811",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463778",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1dc17632-cce7-4ff5-8e1c-0de115098974",
        "value": "eb2fa179fde2f097c18d5d700ad87d660fc238ee14cbe5477032e60856859621",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463779",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a45fe8fd-f357-4f49-b617-6e995b599705",
        "value": "f1efb78887bb8783d7781c07cd13b53c9c79ebe5baa81f335838d0a6e73dec7e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784463779",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0046aa3a-fc59-45c2-8b76-417432aa75c6",
        "value": "f324a45fcd2a9db4e542c09486c21b08bc42d6bf76fbd5f17871090361b10815",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553319",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "be9d5027-e017-44f0-b0a3-c13627da787f",
        "value": "37.32.24.195",
        "Tag": [
          {
            "colour": "#d36688",
            "local": false,
            "name": "asn:asn=\"202468\"",
            "relationship_type": ""
          },
          {
            "colour": "#55e5c2",
            "local": false,
            "name": "asn:as-owner=\"ABRARVAN-AS AbrArvan CDN and IaaS\"",
            "relationship_type": ""
          },
          {
            "colour": "#4b96f6",
            "local": false,
            "name": "asn:as-country=\"IR\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"iran\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553340",
        "to_ids": true,
        "type": "hostname",
        "uuid": "abd64c08-2264-4a97-803e-7daa380d2923",
        "value": "api.digikalas.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553362",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9248a48a-d512-44a5-b61f-d2889180f17f",
        "value": "health.digikalas.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553383",
        "to_ids": true,
        "type": "url",
        "uuid": "7cdaa575-a01d-4ee4-bbec-22a0941ecb71",
        "value": "209.182.237.133:1999/31337",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 2222",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784460863",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "bcfd2cd3-b728-43a0-b6df-23bdcbfe0888",
        "value": "209.182.237.133|2222"
      },
      {
        "category": "Network activity",
        "comment": "On port 9999",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784460863",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "b8053031-874e-44a4-a039-04436e2c7a28",
        "value": "209.182.237.133|9999"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553404",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3b8580b9-d062-4278-ade6-91d9b947cecb",
        "value": "45.145.185.229",
        "Tag": [
          {
            "colour": "#6e3d21",
            "local": false,
            "name": "asn:asn=\"47583\"",
            "relationship_type": ""
          },
          {
            "colour": "#ec60bc",
            "local": false,
            "name": "asn:as-owner=\"AS-HOSTINGER\"",
            "relationship_type": ""
          },
          {
            "colour": "#0f6daf",
            "local": false,
            "name": "asn:as-country=\"CY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d60f3f",
            "local": false,
            "name": "misp-galaxy:country=\"cyprus\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553425",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f284b689-fe68-4515-b581-598a451f131f",
        "value": "107.174.133.119",
        "Tag": [
          {
            "colour": "#6a53a7",
            "local": false,
            "name": "asn:asn=\"36352\"",
            "relationship_type": ""
          },
          {
            "colour": "#9daeac",
            "local": false,
            "name": "asn:as-owner=\"AS-COLOCROSSING\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553446",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9c53c40a-1b9e-4c01-894f-a5966eff8461",
        "value": "188.166.2.226",
        "Tag": [
          {
            "colour": "#c2074e",
            "local": false,
            "name": "asn:asn=\"14061\"",
            "relationship_type": ""
          },
          {
            "colour": "#d7952a",
            "local": false,
            "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784553467",
        "to_ids": true,
        "type": "hostname",
        "uuid": "17938a9a-a634-4737-93f4-826b27d93fe9",
        "value": "captcha.kanfetka.site",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-01-20T02:38:09+00:00",
        "last_seen": "2026-01-20T02:38:09+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784553488",
        "uuid": "449cf5e1-9a53-4fcf-a70b-7384df73d610",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "md5",
            "timestamp": "1784553488",
            "to_ids": true,
            "type": "md5",
            "uuid": "8e419cc9-09a5-4d9d-9c0b-adc43d81cd46",
            "value": "50eadccdd0f2182bdc9f74aa7b3250b5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "sha1",
            "timestamp": "1784463743",
            "to_ids": true,
            "type": "sha1",
            "uuid": "16785b84-3bde-43ba-ace5-df6c80cf9758",
            "value": "12c167b69ad8089299fa342bdc22f99bebea7c01",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "sha256",
            "timestamp": "1784463743",
            "to_ids": true,
            "type": "sha256",
            "uuid": "91212c16-414e-47b1-b603-8b3a78cbd717",
            "value": "71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 19/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "text",
            "timestamp": "1784462641",
            "to_ids": false,
            "type": "text",
            "uuid": "e9f9dd6f-8faa-42db-aadc-1bdc1eaa0c09",
            "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Gafgyt.AX!xp\nClamAV: Unix.Trojan.Mirai-6981158-0\nVT Total Detection: 36/74\nFirst Submission: 2026-01-20T02:38:09+00:00\nLast Submission: 2026-01-20T02:38:09+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784462642",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ddd9ade5-912c-4666-b35c-eb72d8f698f1",
            "value": "49152:X7o1hOUaE1yzCNpAStmD/UF1KurPcauBRW/NhXJpOWAOdESA:rSV1Kurvu3WfOCmSA"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784462642",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f8740b0b-3dd3-4a6f-8de1-d9e3570cec7c",
            "value": "2274688"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "vhash",
            "timestamp": "1784462642",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e68c3b68-809b-4c97-9f76-4a8f69e7d528",
            "value": "6164da2d9d2b641ff54cf174fe599c4f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-20T02:38:09+00:00",
            "last_seen": "2026-01-20T02:38:09+00:00",
            "object_relation": "filename",
            "timestamp": "1784462642",
            "to_ids": true,
            "type": "filename",
            "uuid": "b8f359ca-7fd3-476a-9319-2d10c78bedab",
            "value": ".bot_x86_64"
          }
        ]
      }
    ]
  }
}