{
  "Event": {
    "analysis": "1",
    "date": "2026-03-11",
    "extends_uuid": "",
    "info": "[Threat Intel] Windows and macOS Malware Spreads via Fake \u201cClaude Code\u201d Google Ads",
    "protected": false,
    "publish_timestamp": "1780368450",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780368450",
    "uuid": "19961acf-73c8-4594-8698-6294f9b2d5ca",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#fdcb58",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"somewhat-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#680082",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"MacOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#7f009f",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"WinNT\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1170\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#44212b",
        "local": false,
        "name": "misp-galaxy:producer=\"Bitdefender\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780010006",
        "to_ids": false,
        "type": "link",
        "uuid": "4e15d4d5-9a70-407f-92e4-c50d3ba3e51e",
        "value": "https://www.bitdefender.com/en-us/blog/labs/fake-claude-code-google-ads-malware"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:29/05/2026 No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780298351",
        "to_ids": true,
        "type": "sha256",
        "uuid": "18230323-5330-4bf2-93c7-5e872d49ce7b",
        "value": "eb4d9a0e4c483dc29ae8c4d31fafcd583c457923d3344745b5c7ab13abed4dc5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:29/05/2026 No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780298352",
        "to_ids": true,
        "type": "sha256",
        "uuid": "7d48a215-47e1-403c-85bf-4a26282fe49a",
        "value": "505b32ac2b6fffb5fac81d5bdc2e1e8581fc4196dfb01aee852216a3ad6ff47e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:29/05/2026 No sample in VT\r\nLast check:01/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780298354",
        "to_ids": true,
        "type": "sha256",
        "uuid": "adfd7a1c-855f-47b9-8c81-b928bcbf5ea0",
        "value": "a78e487995ab452c5990b4baff6a4fa485ae2798c2ddd13718c17eb641f11646",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780301038",
        "to_ids": true,
        "type": "url",
        "uuid": "0ac9df3f-8971-4df5-9370-1856d53f0b5a",
        "value": "https://claude-code-cmd.squarespace.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780301059",
        "to_ids": true,
        "type": "url",
        "uuid": "edd40258-4ef0-4947-86f5-f6f6b70a0adf",
        "value": "http://code.claude.ai/download/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780301081",
        "to_ids": true,
        "type": "url",
        "uuid": "2be3a46c-125c-457f-8a56-2e0aeef44e17",
        "value": "https://download.active-version.com/claude",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780301102",
        "uuid": "fb897309-9707-4d8f-ae53-8a252c69b31d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780301102",
            "to_ids": true,
            "type": "md5",
            "uuid": "52bffc96-75e0-4c5c-bdae-729a4e01944a",
            "value": "f2e4f83e998b320b43b4671192917a85",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780296564",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f7d42f87-9184-431b-bb45-e991adbac382",
            "value": "f8a2fb31dfadd1130b0470854cc055e72351fe3c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298344",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d06380df-de4a-4898-a4ea-18d96d182155",
            "value": "79cd21185c51a5bfe2cfebdc51e14b258d91549fc0e4e09b6939c2a8a1c5ac19",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780010249",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1464a990-5912-4b01-bc36-5d1d80dd3e4a",
            "value": "49152:WaKHm1tiaBTYmhrYdlCu7uBAp51b8vPr5LsYSZq:WaF1hBTOdlH74C1b8vL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780010249",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "69552aec-3525-458f-b132-7e86a1fb5649",
            "value": "2493968"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780010249",
            "to_ids": true,
            "type": "vhash",
            "uuid": "bc05986a-0bad-491a-96a7-6ff5380f9ca7",
            "value": "126046656d556113z72z37nz35z62z52001"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780010249",
            "to_ids": true,
            "type": "filename",
            "uuid": "b717cc7a-4ff5-4e3b-9833-5a89ff95a9ba",
            "value": "claude"
          },
          {
            "category": "Other",
            "comment": "Checked: 29/05/2026\nLast-scan\t:  14/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780010249",
            "to_ids": false,
            "type": "text",
            "uuid": "2618b804-ef68-4f1a-80cc-943c4df3e75e",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Alevaul!rfn\nVT Total Detection:44/71\nFirst Submission:2026-03-06T13:01:48.000000+00:00\nLast Submission:2026-04-14T09:44:15.000000+00:00"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  14/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296236",
            "to_ids": false,
            "type": "text",
            "uuid": "f837bce8-f763-4011-8ac2-8c107433e9f7",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Alevaul!rfn\nVT Total Detection:44/71"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296236",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f31dd0d2-73ab-41be-823c-d25ba9390bd3",
            "value": "49152:WaKHm1tiaBTYmhrYdlCu7uBAp51b8vPr5LsYSZq:WaF1hBTOdlH74C1b8vL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296236",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "1bac1756-7be5-4a8c-b662-3560b511d255",
            "value": "2493968"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296236",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4f6d48e3-a9c6-40e8-a0ab-f29f502d46db",
            "value": "126046656d556113z72z37nz35z62z52001"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296236",
            "to_ids": true,
            "type": "filename",
            "uuid": "aa76f49d-93b8-4151-80b8-a802cef04e76",
            "value": "claude"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780301123",
        "uuid": "9a14bdea-2f2f-4d17-b8ad-b07014379758",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780301123",
            "to_ids": true,
            "type": "md5",
            "uuid": "1a9fc518-e5d8-4524-862c-8cb6200f1eef",
            "value": "ae7244062d6eee802f33c15c363ec6a2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298346",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a2e73028-7d14-47ea-85cf-1e5cd07f9c50",
            "value": "baa0a97022a5f87dac0c0077a2fc3d34a7e5588e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298347",
            "to_ids": true,
            "type": "sha256",
            "uuid": "53561574-adcc-49c4-98dd-a0b0ee1e16f0",
            "value": "3b4d3a59024f14cf1f07395afd6957be05d125e00ae8fdcea3a5dee1d8ab9dd3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780010272",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "800550db-0a45-4348-a9b6-f7be34015b22",
            "value": "6144:Af92GsVRW7BibaIKFaWScTnovxsKDqEaHJkfwXX76:HGsNKFnBsFDOHJkoHe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780010272",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6e8788db-3e60-4305-bf0d-f6cb31e625e1",
            "value": "279062"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780010272",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a09af3cb-9804-4b2d-bea2-0280e62edf43",
            "value": "225036651513a0231112z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780010272",
            "to_ids": true,
            "type": "filename",
            "uuid": "0a64a244-8aa5-4f0c-83c7-0edd4592bc40",
            "value": "Circle.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 29/05/2026\nLast-scan\t:  19/03/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780010272",
            "to_ids": false,
            "type": "text",
            "uuid": "0120b88b-8b32-41f8-88f1-9c19e12ed45c",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Alevaul!rfn\nVT Total Detection:43/72\nFirst Submission:2026-03-12T14:41:34.000000+00:00\nLast Submission:2026-03-12T14:41:34.000000+00:00"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296258",
            "to_ids": false,
            "type": "text",
            "uuid": "82c75298-9dd5-45fd-9253-fb00a104dba1",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Alevaul!rfn\nVT Total Detection:49/71"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296258",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4c256942-d507-45d4-8bc0-0e5b42cfc6ed",
            "value": "6144:Af92GsVRW7BibaIKFaWScTnovxsKDqEaHJkfwXX76:HGsNKFnBsFDOHJkoHe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296258",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c717819d-9e72-4ad1-b71f-83e77f131349",
            "value": "279062"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296258",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0dbd3346-02a6-4b99-be4e-611b73439fb5",
            "value": "225036651513a0231112z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296258",
            "to_ids": true,
            "type": "filename",
            "uuid": "205b9c20-6967-4aa5-84ed-e903d36feea3",
            "value": "Circle.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780301145",
        "uuid": "7cbedc53-b201-44de-8ba1-4c9d4c5ae9b3",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780301145",
            "to_ids": true,
            "type": "md5",
            "uuid": "da17cea2-4173-4b43-b171-a933cd5245d7",
            "value": "4448b88c81e4bdaf9e73942c1c237492",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298349",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d9fce5ac-0559-4698-abe4-959694ca53bf",
            "value": "fa38c257d697f7b4d6a433fe95ad5e5732ae3563",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298349",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e30f2a63-45f2-430e-9e9e-e2b08b538362",
            "value": "762fb099115d1917b6f673cc5c74a4b61962a64d640673aaf02566ca6a3dbfa4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780010337",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b7ff4cc6-7252-4936-bc78-c13cb04b0092",
            "value": "49152:79kRHA3xNEBFVm10sPWCm1fswT54twqXE73Aqr9fAIDvrwimVfsATpItwa3o7HAd:pkD1+y2E79ruIDrwDVuymo7N7+IjY"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780010337",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f17c725e-ba64-4ea2-bd00-ce48538d9ce2",
            "value": "18160632"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780010337",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e894dc76-be15-4364-804f-7e1d3adcf662",
            "value": "ab12cf501fd2c6fc4d550becc6116361"
          },
          {
            "category": "Other",
            "comment": "Checked: 29/05/2026\nLast-scan\t:  08/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780010337",
            "to_ids": false,
            "type": "text",
            "uuid": "ddf9ecf8-3e08-487e-9784-0038971339e3",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/AtomicStealer.K!AMTB\nVT Total Detection:29/63\nFirst Submission:2026-03-06T14:43:09.000000+00:00\nLast Submission:2026-03-06T14:43:09.000000+00:00"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  08/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296284",
            "to_ids": false,
            "type": "text",
            "uuid": "603318d4-6872-478f-9df6-d2cbe30fdbf2",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/AtomicStealer.K!AMTB\nVT Total Detection:29/63"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296284",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "15430126-3073-4b41-b9e0-28e316176123",
            "value": "49152:79kRHA3xNEBFVm10sPWCm1fswT54twqXE73Aqr9fAIDvrwimVfsATpItwa3o7HAd:pkD1+y2E79ruIDrwDVuymo7N7+IjY"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296284",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "44afe3ae-0bed-47eb-94be-da60e2934fe8",
            "value": "18160632"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296284",
            "to_ids": true,
            "type": "vhash",
            "uuid": "6ff4ef51-bdc6-415e-892f-df1a2f31f309",
            "value": "ab12cf501fd2c6fc4d550becc6116361"
          }
        ]
      }
    ]
  }
}