{
  "Event": {
    "analysis": "1",
    "date": "2026-06-25",
    "extends_uuid": "",
    "info": "[Threat Intel] KimJongRAT Continues to Evolve by Leveraging LOTS",
    "protected": false,
    "publish_timestamp": "1782525142",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782525142",
    "uuid": "1cd107b6-a8f9-4d33-95a0-3da58d899b37",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#44b2c2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5887a6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Japan\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"KimJongRat\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Kimsuky\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442809",
        "to_ids": false,
        "type": "link",
        "uuid": "911ab291-2c45-4df7-8ffe-2d95a7f30905",
        "value": "https://sect.iij.ad.jp/blog/2026/06/continuous-evolution-of-kimjongrat-2026/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442809",
        "to_ids": false,
        "type": "text",
        "uuid": "904c8c44-6688-4f41-b51a-77db9d8e9e3c",
        "value": "In May 2026, security researchers observed an attack campaign distributing KimJongRAT through GitHub and other legitimate services. KimJongRAT, used by the North Korean APT group Kimsuky since 2013, combines information stealing and remote access capabilities. The infection chain begins with phishing emails containing shortened URLs redirecting to GitHub Releases hosting malicious ZIP files. Victims execute LNK files that download HTA files from GitHub, which then retrieve subsequent payloads from Google Drive. Recent variants demonstrate significant evolution: they now dynamically fetch C2 addresses from external sources rather than hardcoding them, enabling operators to maintain persistent access despite infrastructure takedowns. Additionally, new versions include MeshAgent RMM installation for redundant access. The campaign exemplifies Living Off Trusted Sites (LOTS) techniques, abusing legitimate platforms like GitHub, Google Drive, and Dropbox to evade detection."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442809",
        "to_ids": false,
        "type": "text",
        "uuid": "0bf5efed-f351-478e-8ca3-ea05b3cbc1b9",
        "value": "Name: KimJongRAT Continues to Evolve by Leveraging LOTS\nAuthor: AlienVault\nAdversary: Kimsuky\nTags: [\"kimsuky\", \"lots\", \"infostealer\", \"meshagent\", \"kimjongrat\"]\nTgtd countries: [\"Japan\"]\nMlwr families: [\"KimJongRAT\", \"MeshAgent\"]\nAttack_ids: [\"T1033\", \"T1218.011\", \"T1204.002\", \"T1573.001\", \"T1566.002\", \"T1082\", \"T1005\", \"T1140\", \"T1036\", \"T1055\", \"T1218.005\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1102.002\", \"T1567.002\", \"T1059.003\", \"T1071.001\", \"T1105\", \"T1564.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442809",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "5d0a0d70-13f7-4ba0-a7fc-ddd999a67bc2",
        "value": "Kimsuky"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468860",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "34767d06-56f0-43ec-9143-ac9c36d859ed",
        "value": "104.200.67.46",
        "Tag": [
          {
            "colour": "#8e8779",
            "local": false,
            "name": "asn:asn=\"199959\"",
            "relationship_type": ""
          },
          {
            "colour": "#d781fd",
            "local": false,
            "name": "asn:as-owner=\"CROWNCLOUD\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f61db",
            "local": false,
            "name": "asn:as-country=\"AU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"australia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468883",
        "to_ids": true,
        "type": "hostname",
        "uuid": "af48d6f5-ca7a-4291-9489-533d7b11f217",
        "value": "lutkdd.corpsecs.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468905",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8acad0c3-3b0c-4de2-bf32-9880e439987d",
        "value": "pxqtkc.corpsecs.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Downloader ( sys.dll) No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782467523",
        "to_ids": true,
        "type": "sha256",
        "uuid": "9252740e-6948-495e-b7ae-0f91027cae5f",
        "value": "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "MeshAgent( Taskmgr.exe) No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782467525",
        "to_ids": true,
        "type": "sha256",
        "uuid": "92b71e6c-c6ad-4912-886c-3b681d8f1b7b",
        "value": "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468928",
        "to_ids": true,
        "type": "url",
        "uuid": "343c7e1c-c7a7-4dfa-bd5e-ac61ec019dd4",
        "value": "http://googleoba.servequake.com:8443/agent.ashx",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468950",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d5628a3-1eb9-4fe3-b63d-c79163c5b8c9",
        "value": "googleoba.servequake.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468971",
        "to_ids": true,
        "type": "url",
        "uuid": "4dae0937-05b9-4528-827e-54e7f411e949",
        "value": "https://lutkdd.corpsecs.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782468993",
        "to_ids": true,
        "type": "url",
        "uuid": "b44becb1-1f18-4ec1-a735-8df1060304f4",
        "value": "https://pxqtkc.corpsecs.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "KimJongRAT (DLL version) C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782444830",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "044ae572-fdd9-4513-b20a-9f20eb4402dd",
        "value": "89.116.192.38|443"
      },
      {
        "category": "Network activity",
        "comment": "MeshCentral Server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782469015",
        "to_ids": true,
        "type": "url",
        "uuid": "3feb3af8-046d-42e8-a3b1-44668f5cb37a",
        "value": "wss://googleoba.servequake.com:8443/agent.ashx",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 8443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782444830",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "b74fe1f6-b3f6-4632-a43d-b81777153769",
        "value": "104.200.67.46|8443"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782469038",
        "uuid": "4bf71252-8ec7-4075-af4b-e953212ef54c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "ZIP file containing KimJongRAT (PowerShell version) ( pipe.zip)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782469038",
            "to_ids": true,
            "type": "md5",
            "uuid": "1cab7245-6a9a-439d-8406-5255748b439b",
            "value": "427e98230ce245d6e78b20e52c253d86",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ZIP file containing KimJongRAT (PowerShell version) ( pipe.zip)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467517",
            "to_ids": true,
            "type": "sha1",
            "uuid": "22f0ed23-d33b-46b6-908f-a9eb95498398",
            "value": "9e846a12df1dcb1df90a4ee0b1bf70e70029da5a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ZIP file containing KimJongRAT (PowerShell version) ( pipe.zip)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467518",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1a133842-6287-4e34-b1ac-8699a369dcc3",
            "value": "107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467229",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6b9b209e-fa49-4091-a3e4-c815e9cfe78c",
            "value": "384:whiDWqozKtbssIcULeCSQQR5b9wT48XYK2T0nu0gZBleC6n/Rbb:whiDcsIcvC8Lw48XYK2QuHD6/R"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467229",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ed64045b-cba5-4686-80fb-1729546ef2f2",
            "value": "15431"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467229",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a270d123-a167-4114-a9d5-65389e61ba34",
            "value": "1b7b848fa2043c5294c62b13f3f4f1f6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467229",
            "to_ids": true,
            "type": "filename",
            "uuid": "5f50eca7-7e8c-40d2-8e51-97361ffe552e",
            "value": "pipe.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467229",
            "to_ids": false,
            "type": "text",
            "uuid": "6292172d-838a-48cb-be60-47cb339be61a",
            "value": "ZIP file containing KimJongRAT (PowerShell version) ( pipe.zip)\r\nType Description: ZIP\nMicrosoft: Trojan:Win32/Sonbokli.A!cl\nVT Total Detection:18/65\nFirst Submission:2026-05-27T15:11:37.000000+00:00\nLast Submission:2026-05-27T15:11:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782469060",
        "uuid": "02ff772b-9cfb-4dd2-bc17-2d14f6e04efa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "ZIP file containing LNK files ( tax_edoc.zip)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782469060",
            "to_ids": true,
            "type": "md5",
            "uuid": "9c4d81c4-e6ec-4811-9c47-dc1361b0e429",
            "value": "8bdb7864dd8896d0bc91ecaf2fc1d247",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ZIP file containing LNK files ( tax_edoc.zip)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467520",
            "to_ids": true,
            "type": "sha1",
            "uuid": "82feba70-4d82-40fb-8993-bce42a45948f",
            "value": "a562d436b166fe974470ccb7dc72d446cd39c6ff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ZIP file containing LNK files ( tax_edoc.zip)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467520",
            "to_ids": true,
            "type": "sha256",
            "uuid": "397d9f96-3634-4d07-b341-62ea90ee2093",
            "value": "e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467252",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "32066aa8-d9a2-4e29-8828-9376111dbe0d",
            "value": "48:95HRM+VNmyUfi00tXEoFWULWpZJwVkM+VNmyUfi00tXEoFWULWpZJwVZg6RL8gG:PRM+VNdUfMtXENULM0+VNdUfMtXENULm"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467252",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "90235abb-53cb-40b1-aaf8-b3bd70d40221",
            "value": "2624"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467252",
            "to_ids": true,
            "type": "vhash",
            "uuid": "85fcd107-930c-4694-8300-e72dd858f7e4",
            "value": "3141f7204c6f43e4ee03385d2eee9be8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467252",
            "to_ids": true,
            "type": "filename",
            "uuid": "108ac0e3-6a03-4d4c-b6d5-b6d63101d92f",
            "value": "octet-stream"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467252",
            "to_ids": false,
            "type": "text",
            "uuid": "c2f18319-26b5-4cb1-8ba0-4053177a7625",
            "value": "ZIP file containing LNK files ( tax_edoc.zip)\r\nType Description: ZIP\nMicrosoft: None\nVT Total Detection:35/66\nFirst Submission:2026-05-21T10:49:40.000000+00:00\nLast Submission:2026-05-21T10:49:40.000000+00:00"
          }
        ]
      }
    ]
  }
}