{
  "Event": {
    "analysis": "1",
    "date": "2026-07-29",
    "extends_uuid": "",
    "info": "[Threat Intel] Analysis of BlueShell Variants Used by APT Groups",
    "protected": false,
    "publish_timestamp": "1785643448",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785643448",
    "uuid": "1a2597c1-8b69-44bc-ae85-7b06c54c2abb",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#280b0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0fe1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#08b028",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#e22a4a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credential API Hooking - T1056.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#c295b4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f9cdc4",
        "local": false,
        "name": "misp-galaxy:target-information=\"Indonesia\"",
        "relationship_type": ""
      },
      {
        "colour": "#5887a6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Japan\"",
        "relationship_type": ""
      },
      {
        "colour": "#7dbb86",
        "local": false,
        "name": "misp-galaxy:target-information=\"Singapore\"",
        "relationship_type": ""
      },
      {
        "colour": "#33360c",
        "local": false,
        "name": "misp-galaxy:target-information=\"Thailand\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"BlueShell\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"google\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380429",
        "to_ids": false,
        "type": "link",
        "uuid": "a6a5a62c-42e7-4165-9b56-5d2d6f5a9b7a",
        "value": "https://sect.iij.ad.jp/blog/2026/07/blueshell-variant-deployed-by-apt-group/?amp=1"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380429",
        "to_ids": false,
        "type": "text",
        "uuid": "bbb3b257-3b9f-4830-892a-bdd520483b7a",
        "value": "BlueShell is an open-source remote access trojan developed in Go language, primarily used by Chinese-based threat actors. A variant of BlueShell has been identified in post-intrusion activities by APT groups including BlackTech, targeting organizations in Japan, South Korea, and Thailand. This variant differs from the original through a dedicated dropper mechanism, proxy server-based C2 communication, and anti-forensic capabilities. The dropper deploys the variant to /tmp/kthread, disguises it as a Linux kernel worker process, and removes filesystem traces. Recent variants observed since 2024 include XOR-encoded configuration data and proxy functionality, indicating continuous development. The malware performs hostname verification, validates C2 certificates, and implements commands for file transfer, remote shell, and SOCKS5 proxy capabilities."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380429",
        "to_ids": false,
        "type": "text",
        "uuid": "773bc6e9-13e6-4227-b035-f40a7d20cff2",
        "value": "Name: Analysis of BlueShell Variants Used by APT Groups\nAuthor: AlienVault\nAdversary: BlackTech\nTags: [\"anti-forensic\", \"apt\", \"proxy communication\", \"blueshell\", \"linux\", \"go language\", \"dropper\", \"rat\"]\nTgtd countries: [\"Indonesia\", \"Japan\", \"Singapore\", \"Thailand\"]\nMlwr families: [\"BlueShell\"]\nAttack_ids: [\"T1132.001\", \"T1497.001\", \"T1021.004\", \"T1082\", \"T1090.002\", \"T1083\", \"T1036.004\", \"T1059.004\", \"T1027\", \"T1573.002\", \"T1095\", \"T1070.004\", \"T1071.001\", \"T1105\", \"T1056.004\", \"T1090.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380429",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "3ad0f6b0-4758-4eeb-b571-914960da4964",
        "value": "BlackTech"
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642974",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2533b294-3dd4-47ef-b186-1066b10b3832",
        "value": "48.216.210.91",
        "Tag": [
          {
            "colour": "#4d7cde",
            "local": false,
            "name": "asn:asn=\"8075\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "It appears to be the proxy server of the victim organization.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642996",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ffb1cd91-dd11-4bdd-b11b-2ca32087c41a",
        "value": "10.210.20.254",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-05-03T03:49:03+00:00",
        "last_seen": "2026-05-25T17:51:31+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785643017",
        "uuid": "ff6b8373-c713-4cb0-9565-661500e03156",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "md5",
            "timestamp": "1785643017",
            "to_ids": true,
            "type": "md5",
            "uuid": "fc6f1dec-0642-46b1-88d6-f6fa64c1dd4e",
            "value": "fdc9e765546c72841221b86fe1383c37",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633253",
            "to_ids": true,
            "type": "sha1",
            "uuid": "89cc1f36-566c-4233-9707-dc499c993d21",
            "value": "d7513a05ff14ee84594ec97c1defa37a1e430770",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633253",
            "to_ids": true,
            "type": "sha256",
            "uuid": "934c08fb-59de-4844-935a-bf747b338fd5",
            "value": "944b774d592f5e7fe2c34ac6c3abb2a77bfa96707c4f3c33ac77b8d54800244f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "text",
            "timestamp": "1785632998",
            "to_ids": false,
            "type": "text",
            "uuid": "de259649-82b7-4c06-b895-77a770b18e20",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 29/75\nFirst Submission: 2026-05-03T03:49:03+00:00\nLast Submission: 2026-05-25T17:51:31+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632998",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fed8b104-1264-49a2-bbfa-24488ef6e867",
            "value": "49152:AYpdXyJldPlWxOS4JBsZFZzmmPv0y5uxvg/F:NrXYd4oKkmP8yOvKF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632998",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a107736e-1c05-4ad7-b8f8-1598a66c096e",
            "value": "2916088"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632998",
            "to_ids": true,
            "type": "vhash",
            "uuid": "37b47e3d-def2-4f71-bcc9-0200dfe69b89",
            "value": "de27f7bc48f41da0d44bdb7641781584"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-03T03:49:03+00:00",
            "last_seen": "2026-05-25T17:51:31+00:00",
            "object_relation": "filename",
            "timestamp": "1785632998",
            "to_ids": true,
            "type": "filename",
            "uuid": "2e7629a8-0222-4a7e-b71c-78ee4ffdac6b",
            "value": "nq49fddy.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2025-05-09T16:33:20+00:00",
        "last_seen": "2026-04-09T13:17:51+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785643037",
        "uuid": "fcf3565b-654a-4571-899f-ca905623f3d7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "BlueShell subspecies",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "md5",
            "timestamp": "1785643037",
            "to_ids": true,
            "type": "md5",
            "uuid": "662c5018-f959-4e81-9380-1d856a62ad75",
            "value": "35b08232a0879218674972237217b865",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "BlueShell subspecies",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633254",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4ba65da9-3702-4f4c-8c57-311716e4020f",
            "value": "7df1817ef68960b089a1fad237e2c1d74c6278a8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "BlueShell subspecies",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633254",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8a089c6f-0a55-4559-b732-e5c3eb672aee",
            "value": "3228da011423853efd3d94ce3a28046b5ca19e921861ea5aee2700bc90fc1d55",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "text",
            "timestamp": "1785633020",
            "to_ids": false,
            "type": "text",
            "uuid": "9f90012c-e058-4825-99ab-d9487ffe1e2d",
            "value": "BlueShell subspecies\r\nType Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 25/75\nFirst Submission: 2025-05-09T16:33:20+00:00\nLast Submission: 2026-04-09T13:17:51+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785633020",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0e391a4a-1046-4e71-895e-c8f22c83c08d",
            "value": "49152:Mkoha7bzrb/T4vO90dL3BmAFd4A64nsfJAWLtgxP6C5/Na0aTe5E+Czg4EF82QCn:MsnM40E+7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785633020",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4409ad9b-76b6-4cd2-813b-6e95410e74e2",
            "value": "3764056"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "vhash",
            "timestamp": "1785633020",
            "to_ids": true,
            "type": "vhash",
            "uuid": "aba358c5-41ec-4c55-8597-7af63649701e",
            "value": "24fc1a02b5c73979ee77e13fe50083b4"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-05-09T16:33:20+00:00",
            "last_seen": "2026-04-09T13:17:51+00:00",
            "object_relation": "filename",
            "timestamp": "1785633020",
            "to_ids": true,
            "type": "filename",
            "uuid": "40f79d5e-0739-48ed-bf3c-ed41ac8bfec6",
            "value": "kthread"
          }
        ]
      }
    ]
  }
}