{
  "Event": {
    "analysis": "1",
    "date": "2026-05-27",
    "extends_uuid": "",
    "info": "[Threat Intel] FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch",
    "protected": false,
    "publish_timestamp": "1780377453",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780377453",
    "uuid": "31e1118e-9aa4-4708-8eca-21d21950bfd2",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#d2ee74",
        "local": false,
        "name": "misp-galaxy:producer=\"Arctic Wolf\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052414",
        "to_ids": false,
        "type": "link",
        "uuid": "a6bc2927-f230-45d5-bcec-84b212903e89",
        "value": "https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052414",
        "to_ids": false,
        "type": "text",
        "uuid": "5882fdc6-a66f-4316-98cf-5bc7fe2c866f",
        "value": "In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in FortiClient Endpoint Management Server (EMS), to bypass API authentication and execute privileged requests without credentials. Attackers leveraged trusted endpoint management infrastructure to push malicious PowerShell scripts disguised as legitimate Fortinet patches across managed endpoints. The campaign deployed EKZ Infostealer, a credential-stealing tool targeting Chrome, Firefox, and other browser credentials. The stealer extracts passwords, cookies, and autofill data, staging results locally before exfiltration via HTTP to threat-actor-controlled infrastructure. Threat actors accessed systems through Tor exit nodes, modified VPN configurations to enable script execution, and used FortiClient's own management pathways to distribute payloads fleet-wide without requiring individual endpoint compromises."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052414",
        "to_ids": false,
        "type": "text",
        "uuid": "64447718-58f4-45ce-8f43-bd4d5a5c0bc7",
        "value": "Name: FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch\nAuthor: AlienVault\nAdversary: \nTags: [\"endpoint exploitation\", \"ekz infostealer\", \"forticlient ems\", \"vpn configuration abuse\", \"cve-2026-35616\"]\nTgtd countries: []\nMlwr families: [\"EKZ Infostealer\"]\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052414",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "d873b500-670b-464b-a957-54fb1ab03784",
        "value": "CVE-2026-35616"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052414",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "e94f99f1-8d1e-491e-9bbc-f515f11d7f7b",
        "value": "CVE-2026-0300"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370740",
        "to_ids": true,
        "type": "md5",
        "uuid": "77c7d2b4-e789-44d8-9df5-5df4ba77ac4a",
        "value": "8c5b72906e8183037532afc3f4639931",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373304",
        "to_ids": true,
        "type": "url",
        "uuid": "5bbeff5e-bd3a-41b3-9c25-1df955b59a6e",
        "value": "http://83.138.53.110/dl/p.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373325",
        "to_ids": true,
        "type": "url",
        "uuid": "70a1c446-8121-42ae-95f5-350383ddce69",
        "value": "http://83.138.53.110/service/save.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373346",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "88d81e10-87ac-4b0d-a706-a92c639a6f87",
        "value": "83.138.53.110",
        "Tag": [
          {
            "colour": "#4eba1f",
            "local": false,
            "name": "asn:asn=\"63473\"",
            "relationship_type": ""
          },
          {
            "colour": "#f7847f",
            "local": false,
            "name": "asn:as-owner=\"HOSTHATCH\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373367",
        "uuid": "acd462b9-8696-4be4-90b1-6355dc3c013a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373367",
            "to_ids": true,
            "type": "md5",
            "uuid": "cd113bfa-2129-45f1-ae81-5012653c84f4",
            "value": "338662fd0c4d750a0ba203a32b59f081",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370735",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0bd66440-b8d5-4522-91bd-ba582525a075",
            "value": "17e771c78430cc67e71d4547f8996a1a488e9d3f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370735",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b132e4f5-e8cb-4f6e-bcae-111a139d7ffa",
            "value": "0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369037",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a5306643-6e42-4b1c-879a-99ab6fb8511a",
            "value": "49152:8MA5dS0dGldxqnFlzIovSTnvmcl4XVoO0wlpTKhnpWhMJ2kOa8P2pRUb2bBdk:liWnvmc2VoqEpSMs2bBdk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369037",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e57bb9fa-9a19-491b-be5a-3c20ab4c2b8e",
            "value": "4019070"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369037",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8bf08e86-34c1-4d3c-8b6d-155890942dcd",
            "value": "0461266d7565555c055d0048z6d42=z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369037",
            "to_ids": true,
            "type": "filename",
            "uuid": "570af3c4-3e90-4d78-b9d8-87080486eb9d",
            "value": "FortiEndpoint_Patch.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369037",
            "to_ids": false,
            "type": "text",
            "uuid": "cb0dbef0-e684-4575-b892-a146934f00c4",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:45/71\nFirst Submission:2026-05-09T08:01:35.000000+00:00\nLast Submission:2026-05-13T18:03:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373389",
        "uuid": "9d4ab45e-84e6-4769-b6f6-3bfd3276e8c7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373389",
            "to_ids": true,
            "type": "md5",
            "uuid": "675e7c66-4a98-4303-94b0-1ee0191653e8",
            "value": "898446a6b0585b105c771046b0a417c4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370736",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0b4d45d4-2ad6-43c8-a079-eab6ac183b1c",
            "value": "f83ecfd5db68134d55e6715b915dd96550fece67",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370736",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8d80bc6f-81aa-40eb-a6a5-59702900ad6b",
            "value": "2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369080",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cb595037-4cf0-487e-9ecb-e9bc4b8d8fb3",
            "value": "49152:vwt/wzeAHkeeXpDwPH/mppr/7b+1GM2X+8bXgy793WRltJL/eyn8SPUm6AmNSNWR:vwWHSS+g093gJv8SN6AmNSNWnD0BMs"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369080",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e7cb0b84-4198-4d6b-a223-7d2f8377875a",
            "value": "6495232"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369080",
            "to_ids": true,
            "type": "vhash",
            "uuid": "58836e4f-c790-4b45-a130-cac42145e50b",
            "value": "1660a66d7575555c05151018z3327dz8dz86z2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369080",
            "to_ids": true,
            "type": "filename",
            "uuid": "ac4442f9-4038-449c-8777-9856800fd42a",
            "value": "fil_api_ms_win_crt_apibase_l1_1_0.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369080",
            "to_ids": false,
            "type": "text",
            "uuid": "fb136c9e-2cfa-4d30-82da-0e6292ec6af3",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:39/71\nFirst Submission:2026-05-04T12:16:52.000000+00:00\nLast Submission:2026-05-04T12:16:52.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373410",
        "uuid": "174522ee-4e1a-43c2-9fed-b036d0b9900a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373410",
            "to_ids": true,
            "type": "md5",
            "uuid": "263ae01d-8172-45d3-8cf1-1b6e5a5f715e",
            "value": "2ae6b5f628012497db874ffefed17f06",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370737",
            "to_ids": true,
            "type": "sha1",
            "uuid": "13b0ad28-084f-4fc3-96fb-24961144df2d",
            "value": "93a7a362dc9daf10ad91cc151d7c752ad66dae6f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370737",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5f241530-5ff3-4cc4-ae2a-9de541749722",
            "value": "2f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369101",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b4f3db05-eb86-403f-9393-0d6b84b130c0",
            "value": "98304:/WqbsNDOMdZjLAO7DQI668a0tuNuUdRq:/hbM4O74W4uJc"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369101",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a83b7013-34fd-4faa-93f0-3c1f077079b9",
            "value": "4790272"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369101",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7bbf64c8-f494-4b7e-8c9e-3216244f1715",
            "value": "046096655d75551d15541az2f!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369101",
            "to_ids": true,
            "type": "filename",
            "uuid": "d5407377-4c47-4e03-994a-1ab5acfe843d",
            "value": "Microsoftr Windowsr Operating System-Installer.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369101",
            "to_ids": false,
            "type": "text",
            "uuid": "92be9725-7054-44a0-807c-a1cbe5fc3045",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:45/71\nFirst Submission:2026-05-04T13:25:09.000000+00:00\nLast Submission:2026-05-08T13:59:30.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373431",
        "uuid": "a23b7b58-be32-4d02-bc4f-4673c706ba20",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373431",
            "to_ids": true,
            "type": "md5",
            "uuid": "4fbcc873-048b-4451-8f7c-598fe7df1c0f",
            "value": "f239873bb7d7038e2a0c703b0da4502d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370738",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2e54a951-b80f-418d-9d14-11afdabed545",
            "value": "c37dde82717fae7e84e34c5c83a992440dcc0bb8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370738",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f53c0c57-2120-4995-a2f0-3f2b5b9f2fb9",
            "value": "d91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369124",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1be3920d-a8ac-4d8e-81e3-568a4041718e",
            "value": "49152:hYWaPRMjXddB7MlxdQWo2sx/kHOm2ynJdATOm5+oOT:eWaRMD9QaWo2s1XmjdATMv"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369124",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f650d132-b163-4006-b704-d0e7e39d880f",
            "value": "2000838"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369124",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f676134a-3898-4229-96c3-b14ae90bc4c6",
            "value": "caa7def44cdc9391aaeb59211f423150"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369124",
            "to_ids": true,
            "type": "filename",
            "uuid": "9c7ab6e6-1c7c-48a7-8311-a1940dc033e1",
            "value": "FortiEndpoint_Patch.2.4.9.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369124",
            "to_ids": false,
            "type": "text",
            "uuid": "28b41f46-54ee-43fa-a826-5698e89ae830",
            "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:28/66\nFirst Submission:2026-05-04T12:13:31.000000+00:00\nLast Submission:2026-05-05T00:27:12.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373452",
        "uuid": "8d774abc-1389-4d2b-aeb3-8a13a76cfcb3",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373452",
            "to_ids": true,
            "type": "md5",
            "uuid": "431df7bf-6847-41f0-86e6-8c9e02fc9fc2",
            "value": "675212733d62fa2873dea33760eb6bc0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370739",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f1530453-b2d6-4576-938e-ac25f38bf619",
            "value": "738295096bfa17a56623926941a432b2729e58c7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370739",
            "to_ids": true,
            "type": "sha256",
            "uuid": "14398c30-b374-482d-9ee2-e712a8b49da1",
            "value": "fd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369146",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "26025a85-f813-4f04-8d33-3e97dbdf0aa9",
            "value": "49152:NSHRShHylX5jbp85ttOu42OkROu4SZHfUv8TPCM+r:NSxeHypJm4u42O1uvfUvxV"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369146",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "623f29ec-04e6-41e6-802d-a113767c8240",
            "value": "2215936"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369146",
            "to_ids": true,
            "type": "vhash",
            "uuid": "799a4ed6-55f5-456d-89e0-97ff669a2fac",
            "value": "034724c1d28ccc0d2ba7899cae27f397"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369146",
            "to_ids": true,
            "type": "filename",
            "uuid": "4242163e-572f-401e-a85a-dcd34495e31d",
            "value": "FortiEndpoint_Patch.2.4.9.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369146",
            "to_ids": false,
            "type": "text",
            "uuid": "6264486a-52e0-4e7d-8522-a392c404804e",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:27/62\nFirst Submission:2026-05-04T12:15:03.000000+00:00\nLast Submission:2026-05-05T11:15:19.000000+00:00"
          }
        ]
      }
    ]
  }
}