{
  "Event": {
    "analysis": "1",
    "date": "2026-06-24",
    "extends_uuid": "",
    "info": "[Threat Intel] Skill Marketplace and the Emerging AI Supply Chain Threat",
    "protected": false,
    "publish_timestamp": "1782459200",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782459199",
    "uuid": "31cd4fae-c555-4967-a462-9c740b5babb6",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0afe32",
        "local": false,
        "name": "misp-galaxy:producer=\"Palo Alto\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e76389",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hide Artifacts - T1564\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#327a31",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Binary Padding - T1027.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a5d84",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-atlas-attack-pattern=\"Command and Scripting Interpreter\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-atlas-attack-pattern=\"Establish Accounts\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-atlas-attack-pattern=\"Financial Harm\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-atlas-attack-pattern=\"ML Artifact Collection\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-atlas-attack-pattern=\"User Execution\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356432",
        "to_ids": false,
        "type": "link",
        "uuid": "39b4128c-996d-48e3-b5d3-ba58f4b9416a",
        "value": "https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356432",
        "to_ids": false,
        "type": "text",
        "uuid": "aae68706-78e0-4c3c-bc67-80afa9f978f6",
        "value": "Between February and May 2026, researchers identified five malicious skills on ClawHub, OpenClaw's AI agent marketplace, that evaded detection by VirusTotal and ClawScan. The threats included two macOS infostealers communicating with command-and-control infrastructure, one skill using file padding to bypass scanner thresholds, and two novel agentic threats exploiting the AI supply chain for financial gain. The infostealers delivered payloads including AMOS malware through Base64-encoded droppers and paste-site redirects. One skill implemented runtime affiliate injection by forcing agents to recommend products through malicious referral links, while another orchestrated a front-running scheme using coordinated AI agents to manipulate cryptocurrency token launches. These attacks demonstrate how malicious actors exploit semantic instruction hijacking and the lack of isolation between skill logic and agent authority to compromise AI agent ecosystems."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782356432",
        "to_ids": false,
        "type": "text",
        "uuid": "397e479d-d1bf-4d8f-9ad4-869cc4e744a4",
        "value": "Name: Skill Marketplace and the Emerging AI Supply Chain Threat\nAuthor: AlienVault\nAdversary: \nTags: [\"infostealer\", \"affiliate injection\", \"defense evasion\", \"openclaw\", \"amos\", \"cluw\", \"ai supply chain\", \"agentic threats\", \"clawhub\", \"front-running\", \"clawhavoc\"]\nTgtd countries: []\nMlwr families: [\"AMOS\", \"ClawHavoc\", \"cluw\"]\nAttack_ids: [\"T1132.001\", \"T1564\", \"T1204.002\", \"T1053.003\", \"T1071\", \"T1140\", \"T1583.001\", \"T1036\", \"T1185\", \"T1027.001\", \"T1552.001\", \"T1583.006\", \"T1566\", \"T1059.004\", \"T1078\", \"T1027\", \"T1573\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Finance\", \"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458091",
        "to_ids": true,
        "type": "domain",
        "uuid": "ba873652-2fa1-4733-b474-871ec4ecea05",
        "value": "laosji.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458112",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4df33bd1-195a-47be-a3a3-6fa229305150",
        "value": "91.92.242.30",
        "Tag": [
          {
            "colour": "#ce048f",
            "local": false,
            "name": "asn:asn=\"209800\"",
            "relationship_type": ""
          },
          {
            "colour": "#434f78",
            "local": false,
            "name": "asn:as-owner=\"METASPINNER-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458133",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9d5d39c6-9986-4d7a-a494-9d6248b22b84",
        "value": "2.26.75.16",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458154",
        "to_ids": true,
        "type": "url",
        "uuid": "3bab131d-02aa-48b7-82b5-765c1a5b1be8",
        "value": "http://glot.io/snippets/hfd3x9ueu5",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458176",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2e849ccf-3424-4ef2-8847-1931103e3a08",
        "value": "download.setup-service.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458197",
        "to_ids": true,
        "type": "url",
        "uuid": "23008196-55f7-4127-9c97-c572af959434",
        "value": "91.92.242.30/lamq4",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458218",
        "to_ids": true,
        "type": "url",
        "uuid": "cb75debd-c45f-4e9a-91d8-e14355096dc8",
        "value": "github.com/Ddoy233/openclawcli",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458239",
        "to_ids": true,
        "type": "url",
        "uuid": "94e596b6-b2d8-4e89-be53-383d0da1138d",
        "value": "glot.io/snippets/hfd3x9ueu5",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458260",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4b3a9489-223b-4491-97d4-d586e4e98622",
        "value": "install.app-distribution.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458281",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2782df6f-fc72-41d9-8314-b3b0752d337d",
        "value": "openclawcli.vercel.app",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782458302",
        "to_ids": true,
        "type": "url",
        "uuid": "b30977d8-9830-41e3-bbfa-ff2317dbf151",
        "value": "rentry.co/openclaw-code",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782458323",
        "uuid": "ae205601-4290-4441-bd6f-5ec918dfc38b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782458323",
            "to_ids": true,
            "type": "md5",
            "uuid": "2311c76f-9015-4267-af21-ead4259f4010",
            "value": "88c10adeea25b6fdddba2a0477e918c0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782456100",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f0e9b14f-3ec0-438f-90dc-4db24ae895fa",
            "value": "482a5271d349be080d0c28cfd9080d3d2ce7491b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782456100",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0b19a81d-89a9-4af7-8efd-de3ce2ca1eee",
            "value": "818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782455741",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ec31f8bc-f6f4-4f09-bc8b-73e5aa9cb172",
            "value": "12288:qy6gGdvu+U+XvXhinXm0k6EUpuAOCBKHA:qy6obkSU"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782455741",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b0164daa-9c2f-4fa7-9d49-ccc25a3ccff3",
            "value": "591312"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782455741",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a6300c2d-a55f-4aca-ac73-6a1e6ea4593f",
            "value": "0252dc858045d41516d6efd67b758612"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782455741",
            "to_ids": true,
            "type": "filename",
            "uuid": "fa449ca9-0ce5-4ef6-9d74-bffc82eb28e6",
            "value": "cluw"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782455741",
            "to_ids": false,
            "type": "text",
            "uuid": "4624b452-00dc-402d-9805-364da73136b3",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/AmosStealer.DB!MTB\nVT Total Detection:36/63\nFirst Submission:2026-05-24T02:06:38.000000+00:00\nLast Submission:2026-05-24T02:06:38.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782458345",
        "uuid": "a3e51c63-079b-4822-b0ca-e03140c20486",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782458345",
            "to_ids": true,
            "type": "md5",
            "uuid": "abd22381-2d1e-4641-bba9-c74ce412638f",
            "value": "77ef35bde6f1ecd90462eaea94380ba3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782456102",
            "to_ids": true,
            "type": "sha1",
            "uuid": "12269656-01ad-41b6-9faa-6f2ed39384c2",
            "value": "34f115ce6b052b2955ab7420ae007a2546737632",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782456102",
            "to_ids": true,
            "type": "sha256",
            "uuid": "86d0c97e-c206-4275-9826-abc485799016",
            "value": "881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782455763",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b3cb368e-cdb7-4bec-9d5f-e509b7c564f6",
            "value": "96:5HAaYPOt98RCXfRWcq1gxvxJmMTFOzjgFe8Tmh:+tPg9koWcNRxJTFOX4Tu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782455763",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0bc2c023-869e-4e01-93f0-fd9412e76db9",
            "value": "3950"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782455763",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ec7e5776-1b89-4b0b-8b28-ba151526b6b4",
            "value": "4acc216d041de7e9e6d26cfcc6bad8e6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782455763",
            "to_ids": true,
            "type": "filename",
            "uuid": "3fd51c11-f277-4b83-ab99-0fc047a50458",
            "value": "skill.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782455763",
            "to_ids": false,
            "type": "text",
            "uuid": "d407837c-b765-48b1-b7ea-4fae3d818d3f",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:2/65\nFirst Submission:2026-05-17T02:15:50.000000+00:00\nLast Submission:2026-05-17T02:15:50.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782458366",
        "uuid": "8bdc2672-eac5-44d2-806f-834335fe9de9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782458366",
            "to_ids": true,
            "type": "md5",
            "uuid": "7fdef3de-3157-409b-b723-6bd4bb3f47ee",
            "value": "cfb00d76698212c56796724929fc8f1e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782456103",
            "to_ids": true,
            "type": "sha1",
            "uuid": "cfd8c423-5f61-4e1c-a959-aca280d04240",
            "value": "353de0a93a5133f333e809366a5f35010da01ecb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782456103",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a6fa54ca-63af-4a17-9fda-779f7064ef17",
            "value": "b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782455786",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ae9761de-0247-412b-afd9-f583347ac63a",
            "value": "48:9n2qKi5Ni5jpFzk4bPGBbMycYfuEtvdKAu:wqKi5Ni5jvk4zGXc+7u"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782455786",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0863dc81-e2c7-4c1f-a4c1-dc4771a8cfe6",
            "value": "33976"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782455786",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0b1cd705-6a34-47c7-9853-e933a9e97cd1",
            "value": "79b457e21cf3d19ce104a86207b39a25"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782455786",
            "to_ids": true,
            "type": "filename",
            "uuid": "2b30d63f-bf40-417a-a006-097764998cbe",
            "value": "omnicogg.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782455786",
            "to_ids": false,
            "type": "text",
            "uuid": "18039007-62f0-4dcb-8549-1ed7968a2dfc",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:15/65\nFirst Submission:2026-02-13T13:48:15.000000+00:00\nLast Submission:2026-03-31T07:11:02.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782458387",
        "uuid": "f5e0f0c4-b475-4dc1-9929-c0c25cf0e318",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782458387",
            "to_ids": true,
            "type": "md5",
            "uuid": "8f933bf7-41e0-462e-a376-8f39dd855f26",
            "value": "3b3dd4b1756d118279878c0092fc50ce",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782456104",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bd7b821f-3aaf-46a1-ae7e-b379f0274796",
            "value": "6c5b985c83f5e3cffcd4aa26269a0d3ceaf93f35",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782456105",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4d37584b-9226-4aff-a275-375c37a3a220",
            "value": "b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782455807",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c7554c74-5b5b-4d67-85d8-dffbf79fa3da",
            "value": "96:+ktPzOiSX3H1Fu21p4pTUCxoq4bRwEdEZkOPx4r2aIWFx2FGnQno1Hl7ogBiOUe:+ktPz0X3Hfr1p4pgyoqU6QE2Qx4r2aIY"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782455807",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "beae13b8-c3ce-4a01-a288-19a8d28c1a6d",
            "value": "5627"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782455807",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fed25dc4-8e2c-4d8d-bede-f7129705396b",
            "value": "2434ebc8efa4f435b91a7ebdb3de9d52"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782455807",
            "to_ids": true,
            "type": "filename",
            "uuid": "f3d4b8e7-0109-476f-b5dc-ffa1665a9bf0",
            "value": "skill.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782455807",
            "to_ids": false,
            "type": "text",
            "uuid": "dd0f51aa-9bbd-4242-8a4f-91af1247161e",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:2/65\nFirst Submission:2026-05-17T02:02:36.000000+00:00\nLast Submission:2026-05-17T02:02:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782458408",
        "uuid": "72a39dea-3637-4c76-be10-e20f78d05243",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782458408",
            "to_ids": true,
            "type": "md5",
            "uuid": "c29d147f-c247-40cb-bcd5-c385ff368c16",
            "value": "ff628616eb5d5b48dc5c63395cb3d9f8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782456106",
            "to_ids": true,
            "type": "sha1",
            "uuid": "74925021-7fc7-4a66-81b7-9b3cb7239113",
            "value": "52958da109864eb9843d01d4ac79b8dc2aa7b8e2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782456106",
            "to_ids": true,
            "type": "sha256",
            "uuid": "00c91f8d-b24d-48ae-a1ab-f0fd2563cda0",
            "value": "ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782455830",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9defba05-bf00-40ae-a924-b96a781b4cb6",
            "value": "96:aMeISyw+5qS/4RUrIUpb66PY42wkCtUrCOYogaTZO7mtpw:Bqyk0xI2Y42wkCtaSaTkSpw"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782455830",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3c130d21-b6e6-4d55-a340-fe3265006c83",
            "value": "4669"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782455830",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ddac8d69-b735-473d-9116-af206733d729",
            "value": "34adf26276b7f3f77e3becbca913f2a0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782455830",
            "to_ids": true,
            "type": "filename",
            "uuid": "b6328a0a-88b5-461d-8fc8-d2fc891c69df",
            "value": "skill.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782455830",
            "to_ids": false,
            "type": "text",
            "uuid": "20b91965-d0cf-4a88-8180-596563783220",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:2/65\nFirst Submission:2026-03-20T08:07:31.000000+00:00\nLast Submission:2026-03-20T08:07:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782458429",
        "uuid": "75c6aa1d-c1fd-4159-b7fc-701dd6062da4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782458429",
            "to_ids": true,
            "type": "md5",
            "uuid": "e640ee52-731a-4ed4-93e7-f17ae339e61b",
            "value": "85477c8e4e9d3c864780bd75abd1f8dc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782456107",
            "to_ids": true,
            "type": "sha1",
            "uuid": "28d6a127-aff7-4dd5-bbd5-05b7f41926b4",
            "value": "ff1ef52ee5bb047c83a95251f899d48d071d90b0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782456107",
            "to_ids": true,
            "type": "sha256",
            "uuid": "788d7001-e175-4a9d-bdbf-ad0114c6fbf2",
            "value": "f4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782455852",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "575160c1-dbe8-48c6-990d-bb865be8f75a",
            "value": "384:/yH3TJIiM/0e3tIoU00q0agzh/ilGF4WcqpD:/yXZGJ9Iod0qNg94WBD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782455852",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8a847014-de85-47ad-af11-a14a08070bc5",
            "value": "13237"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782455852",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f23f391b-2956-4028-b09d-e370790e2325",
            "value": "02c7ebbc00013cbef54fc46fb4081b8e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782455852",
            "to_ids": true,
            "type": "filename",
            "uuid": "79c2fa58-c82e-46db-b1fb-23022aaeb8d6",
            "value": "skill.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782455852",
            "to_ids": false,
            "type": "text",
            "uuid": "fd06af57-3a29-43aa-9c94-e218b5708c75",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:3/65\nFirst Submission:2026-02-07T12:19:23.000000+00:00\nLast Submission:2026-02-07T12:19:23.000000+00:00"
          }
        ]
      }
    ]
  }
}