{
  "Event": {
    "analysis": "1",
    "date": "2026-05-20",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure",
    "protected": false,
    "publish_timestamp": "1780196742",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780196742",
    "uuid": "271f7352-0846-4ffc-9841-b0e792521cbc",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#57356b",
        "local": false,
        "name": "misp-galaxy:producer=\"Seqrite\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#52d590",
        "local": false,
        "name": "misp-galaxy:target-information=\"China\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Debugger Evasion - T1622\"",
        "relationship_type": ""
      },
      {
        "colour": "#44b2c2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c8f8ef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418839",
        "to_ids": false,
        "type": "link",
        "uuid": "7845712b-666e-4e37-a500-a626e875f812",
        "value": "https://www.seqrite.com/blog/operation-dragon-whistle-ung002-targets-chinese-academia-via-weaponized-institutional-lure/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418839",
        "to_ids": false,
        "type": "text",
        "uuid": "f0c93366-07db-416a-a325-7b9d6b6a965a",
        "value": "A sophisticated spear-phishing campaign designated Operation Dragon Whistle has been identified targeting Changzhou University in China. The threat actor UNG002 leveraged highly contextual social engineering by impersonating official university communications regarding mandatory 2026 National Student Physical Fitness and Health Standards testing, which directly impacts graduation eligibility. The attack chain begins with a weaponized ZIP file containing a malicious LNK file disguised as a PDF document. Upon execution, it triggers a VBScript that simultaneously displays a legitimate-looking decoy document while deploying a multi-stage infection chain involving DLL sideloading via Bandizip.exe, anti-debugging techniques, and ultimately delivering a Cobalt Strike Beacon payload entirely in memory. The campaign demonstrates advanced evasion capabilities and utilizes Chinese cloud infrastructure hosted on Alibaba Cloud for command and control operations."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418839",
        "to_ids": false,
        "type": "text",
        "uuid": "0c1baedc-0c69-4a32-802f-720db9683732",
        "value": "Name: Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure\nAuthor: AlienVault\nAdversary: UNG002\nTags: [\"spear-phishing\", \"dll sideloading\", \"in-memory execution\", \"education sector targeting\", \"social engineering\", \"chinese academia\", \"cobalt strike\", \"anti-debugging\"]\nTgtd countries: [\"China\"]\nMlwr families: [\"Cobalt Strike - S0154\"]\nAttack_ids: []\nIndustries: [\"Education\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780146958",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "2476ed51-9588-416e-970e-0560d87e507a",
        "value": "UNG002",
        "Tag": [
          {
            "colour": "#57356b",
            "local": false,
            "name": "misp-galaxy:producer=\"Seqrite\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike Beacon No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150030",
        "to_ids": true,
        "type": "sha256",
        "uuid": "9a158ea8-2ffb-466d-9db2-1ce7ccb738cf",
        "value": "ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780196318",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5745899b-d299-46ca-8f5a-3f46ae33988d",
        "value": "60.205.186.162",
        "Tag": [
          {
            "colour": "#5d39d0",
            "local": false,
            "name": "asn:asn=\"37963\"",
            "relationship_type": ""
          },
          {
            "colour": "#76d941",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780196339",
        "to_ids": true,
        "type": "domain",
        "uuid": "7accd6bf-d058-4df0-82b6-c5f28380c669",
        "value": "lysander.asia",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780196360",
        "uuid": "a25dcd52-4fc5-47e0-a97c-828d328235ad",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780196360",
            "to_ids": true,
            "type": "md5",
            "uuid": "1c0398ce-57e9-4d45-8e13-33fae44b53f1",
            "value": "a77059fa6934f64172013d9a910b6aec",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780150023",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8be0ee54-28d2-4eba-b068-4a056df74a5f",
            "value": "291c881f7369f9f0a6ec9f51fe8f5d93094ddbb0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780150024",
            "to_ids": true,
            "type": "sha256",
            "uuid": "43392584-d404-4615-b504-d177b17d3155",
            "value": "35a478f53f64bd412f374c65360fdba0518749537193669a8fe08d14bed65a2a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780149455",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2a08604d-abe4-4169-bac9-ff3c0cf5074b",
            "value": "3072:PbaaYXCEtbM6gsS4Q9xrB86nZnGYQ8iv+M481VYG8:jaa0CGjUH8YNl81f"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780149455",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c0f03f55-f047-46ba-8e8e-481979d9ba08",
            "value": "150528"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780149455",
            "to_ids": true,
            "type": "vhash",
            "uuid": "972a6c83-e7bc-4e6f-8a0b-2ba6802651e7",
            "value": "115066655d155d055az4e?z2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780149455",
            "to_ids": true,
            "type": "filename",
            "uuid": "3282853d-6b90-4f60-aa71-3df01ee343c1",
            "value": "ark.x64.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780149455",
            "to_ids": false,
            "type": "text",
            "uuid": "92b6cbd4-9521-4649-9cb9-38bdd20b290d",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/DragonWhistle.PAHJ!MTB\nVT Total Detection:34/71\nFirst Submission:2026-05-10T08:35:01.000000+00:00\nLast Submission:2026-05-10T08:35:01.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780196381",
        "uuid": "494e3fc6-ecb8-49bc-99ca-011d7eb30346",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780196381",
            "to_ids": true,
            "type": "md5",
            "uuid": "77b642d9-cdf7-46a8-82b5-b3dc8697d08e",
            "value": "902533852b16b6ba322bf33de0e4215e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#2c2142",
                "local": false,
                "name": "false-positive:risk=\"high\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780150024",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0bbc522f-fd7f-40e3-88f8-289f38afccfe",
            "value": "b5fa57a839f7d63ea8d5d00a9cd5a143777e7da9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#2c2142",
                "local": false,
                "name": "false-positive:risk=\"high\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780150025",
            "to_ids": true,
            "type": "sha256",
            "uuid": "bdbb4d22-e5aa-4ba4-aecf-056d6e231c29",
            "value": "c937eca7c4c9b98df9257d986e666d25411aac5fa39d21f7018dd2e1663f0c76",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#2c2142",
                "local": false,
                "name": "false-positive:risk=\"high\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780149477",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7f779d23-7cf8-435c-8976-a7fb9640802d",
            "value": "49152:2n9s4c+KI0nVm08og7jWrBTt1Yt3LlcfZZiV9VX9Oa3MN9HUnwdO+I:U+Ie1tueiV9V+I"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780149477",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "35a530ae-b21f-45b9-9572-a105f51d83d6",
            "value": "3474568"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780149477",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8bfcc7ca-e86f-4df2-9f70-3f59d1e5d951",
            "value": "036096655d156d1d0d055160b04001d00c96z13054z1c09009f0411bz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780149477",
            "to_ids": true,
            "type": "filename",
            "uuid": "01acbe0d-c729-4cd7-8881-9c7f9a4a4951",
            "value": "Bandizip.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780149477",
            "to_ids": false,
            "type": "text",
            "uuid": "ef7e8f4a-1d91-4cd4-bef0-63281caaea8a",
            "value": "Type Description: Win32 EXE\nFile distributed by: ['Bandizip']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['Bandizip.x64.exe']\nMicrosoft: None\nVT Total Detection:0/71\nFirst Submission:2025-09-10T08:14:56.000000+00:00\nLast Submission:2026-05-05T08:39:50.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780196403",
        "uuid": "9a4a62e3-f690-40d7-8cae-8d801aa1c6b6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780196403",
            "to_ids": true,
            "type": "md5",
            "uuid": "4e1e7623-f0c3-4d21-855b-758db00b7cd5",
            "value": "f338f4c64f7daa69a7da2132f4ea96b3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780150025",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1788c686-43f1-424f-a31f-d25f7bffdffa",
            "value": "05774c05ac3b5a2e70eef2baf64a2534736aba55",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780150025",
            "to_ids": true,
            "type": "sha256",
            "uuid": "11c2db17-b4e5-45fb-9d0f-bc67d0dae0ce",
            "value": "cd99e83d241cfbb41bfcd0bc622a87d16268e710ca7d736d0c5f44774e0056e2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780149499",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9eb60d24-be49-42c1-9602-b5af82934dc8",
            "value": "24:8nIn3iuPX6vUtJU1+IMHq3D14I0+2b7SzUrHoq/phRC9eu3+IMmmQ:8Inyu/6vyJUdMK3DKIZE7SzkHbphdu3p"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780149499",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "569304de-7d2c-4ff8-84b0-34e755d0234d",
            "value": "1325"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780149499",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fc15d640-4904-43a1-9689-b465e4b5e744",
            "value": "f6f6780782c830711dce39d17cb6cb98"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780149499",
            "to_ids": true,
            "type": "filename",
            "uuid": "bea65adc-a08e-4d47-a681-d5d1b5420b1d",
            "value": "\u5e38\u5dde\u5927\u5b662026\u5e74\u300a\u56fd\u5bb6\u5b66\u751f\u4f53\u8d28\u5065\u5eb7\u6807\u51c6\u300b\u6d4b\u8bd5\u901a\u77e5.pdf.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780149499",
            "to_ids": false,
            "type": "text",
            "uuid": "bee321e7-4315-4efd-b938-c19ed2fab80c",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Leonem!rfn\nVT Total Detection:20/62\nFirst Submission:2026-05-10T10:14:03.000000+00:00\nLast Submission:2026-05-10T10:14:03.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780196424",
        "uuid": "c03d5f2e-9819-43e8-8d30-6b4dca3cd476",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780196424",
            "to_ids": true,
            "type": "md5",
            "uuid": "2eb5c657-300f-42b0-831d-59dfe4accbfd",
            "value": "e118c1ad33ef86543f2d71477df3c419",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780150027",
            "to_ids": true,
            "type": "sha1",
            "uuid": "05cf6f21-6b4e-414c-9585-f46f8ace0e85",
            "value": "57cb6e2810f028a370bb3945547fb817759e8b88",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780150027",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a81ceab6-706a-4ca7-94fb-397089d6dfa3",
            "value": "e7aff6a55a7866776272d9913dfbf9d7db33fc9de6aced22f2a195feebb0e85f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780149521",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "456695e3-0773-4946-98c7-b52af0315ad5",
            "value": "49152:FxG1z29dpppV3wA460AfFZgh1gUPJLUvYhQ0xtY5+cacKTciad13Va6KEMCt:i1z2f7cAfFZgnJwvYRY5+nitZKst"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780149521",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "023a0540-5dd3-4b59-bd77-6d8c04c9b06f",
            "value": "2762405"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780149521",
            "to_ids": true,
            "type": "vhash",
            "uuid": "879afc98-13e8-44b0-82e5-3034070cebee",
            "value": "53f99d421b9b90dff37816ebadb9c1c2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780149521",
            "to_ids": true,
            "type": "filename",
            "uuid": "dff96032-8cbd-4e22-a883-6c68ef3e0379",
            "value": "\u5e38\u5dde\u5927\u5b662026\u5e74\u300a\u56fd\u5bb6\u5b66\u751f\u4f53\u8d28\u5065\u5eb7\u6807\u51c6\u300b\u6d4b\u8bd5\u901a\u77e5\u6700\u7ec8\u7248.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780149521",
            "to_ids": false,
            "type": "text",
            "uuid": "5c049463-186f-4981-88f7-921a102d529c",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:40/68\nFirst Submission:2026-05-10T10:14:18.000000+00:00\nLast Submission:2026-05-10T10:14:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780196445",
        "uuid": "c9da12b5-7908-4f00-bfb0-11b1a26c6995",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780196445",
            "to_ids": true,
            "type": "md5",
            "uuid": "0abd64ce-7e79-417e-89b8-9a9c4b1f3d1b",
            "value": "ea4fff8804db2aa0ff664422afb171d5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780150028",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4fe8ae8b-7ddd-4b39-984d-c92ff4a1938b",
            "value": "b928718abf20a123ba3a3f122af9bb4c6e3f8144",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780150028",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ad44242c-4e9d-4d15-b283-b79dadaba205",
            "value": "eb14d9e35a3bf0a933297f861bee0be9e6b9061fe4573a81ac92b71d55b6474f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780149543",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "887e2442-c0e2-46ba-aa91-4ed96e2af212",
            "value": "49152:3SS8gihsBbUtMtjfSijb4uDLg93whIQpiXMg89p84i5xUtC:w"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780149543",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0d7d8f60-a35c-4aba-9522-33e8cea0dcd2",
            "value": "3786891"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780149543",
            "to_ids": false,
            "type": "text",
            "uuid": "2f7cdd3f-32e3-4b14-8112-aa5dbffc17de",
            "value": "Type Description: Email\nMicrosoft: None\nVT Total Detection:27/62\nFirst Submission:2026-05-10T10:04:49.000000+00:00\nLast Submission:2026-05-10T10:04:49.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780196466",
        "uuid": "c4a7208f-efdf-4e13-9618-77c91e16706c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780196466",
            "to_ids": true,
            "type": "md5",
            "uuid": "8feb7188-d9e0-4cdd-abbc-66863d19b0a3",
            "value": "276fcf28045a3c05a1977816924fca17",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780150029",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5f1f8231-7b2e-46b0-b021-80ab84f746e5",
            "value": "bf83ac111f3688fa63f010e59fff91db9845cbd8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780150029",
            "to_ids": true,
            "type": "sha256",
            "uuid": "007f00b3-9a81-4a56-9ee4-07648b56328f",
            "value": "fe11b199ada23d5ac25efc4215e67f4ff617ccb4d429eb64412072687367ca1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780149586",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "37aa0368-3fd3-494a-a2e3-d2f7475df87e",
            "value": "3072:Y4fP8LORajjYQbjrYzrY6XrFfLOsG+ukGBaETs:BPPavYMYU0RDdurBaETs"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780149586",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ba2d91e8-a505-4a1a-ada6-6cca7f92d77b",
            "value": "139274"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780149586",
            "to_ids": true,
            "type": "vhash",
            "uuid": "afc9a3dd-62bb-4fe2-a411-1d4fba23aea9",
            "value": "9891419e825a9641fc7302fc8cb8500ca"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780149586",
            "to_ids": true,
            "type": "filename",
            "uuid": "a51d88f6-cb1a-4f59-9253-8260b7207e00",
            "value": "\u5e38\u5dde\u5927\u5b662026\u5e74\u300a\u56fd\u5bb6\u5b66\u751f\u4f53\u8d28\u5065\u5eb7\u6807\u51c6\u300b\u6d4b\u8bd5\u901a\u77e5.pdf"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780149586",
            "to_ids": false,
            "type": "text",
            "uuid": "ac70ff02-d75d-4a90-bb4f-b9d3a362a7c6",
            "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-05-10T10:14:15.000000+00:00\nLast Submission:2026-05-10T10:14:15.000000+00:00"
          }
        ]
      }
    ]
  }
}