{
  "Event": {
    "analysis": "1",
    "date": "2026-07-06",
    "extends_uuid": "",
    "info": "[Threat Intel] Vidar Infostealer Being Spread through Phishing Emails",
    "protected": false,
    "publish_timestamp": "1784349305",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784349305",
    "uuid": "3b33a373-56c3-4ec3-a8bc-8ed5a4173e06",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#bb889f",
        "local": false,
        "name": "misp-galaxy:producer=\"AhnLab\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#f4b62b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#865fd1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Credential Manager - T1555.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Vidar\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"WinSCP\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783652411",
        "to_ids": false,
        "type": "link",
        "uuid": "77625092-04e3-4335-a809-31beb2bc72f7",
        "value": "https://asec.ahnlab.com/en/94363/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783652411",
        "to_ids": false,
        "type": "text",
        "uuid": "e3e1a7c7-9ca5-4045-8b40-5c2c9657c0fb",
        "value": "Vidar, a Malware-as-a-Service infostealer first identified in 2018, continues to be distributed through phishing campaigns targeting Korea in the first half of 2026. The threat actor uses phishing emails disguised as job applications and copyright infringement notices, with attachments appearing as Word documents but actually being executables. Vidar employs a Go-based packer, uses Dead Drop Resolver technique via Telegram and Steam profiles to obtain C&C addresses, and implements anti-debugging and anti-VM techniques. The infostealer exfiltrates sensitive information including browser credentials, cookies, browsing history, cryptocurrency wallet data, Discord tokens, Telegram information, Steam data, Azure credentials, and screenshots. Configuration information is downloaded in JSON format, and data collection is performed based on received flags and additional downloaded conditions."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783652411",
        "to_ids": false,
        "type": "text",
        "uuid": "53633fc3-e25b-42ba-964d-f98252f8f0ac",
        "value": "Name: Vidar Infostealer Being Spread through Phishing Emails\nAuthor: AlienVault\nAdversary: \nTags: [\"dead drop resolver\", \"discord\", \"infostealer\", \"browser credential theft\", \"cryptocurrency theft\", \"steam\", \"telegram\", \"phishing\", \"vidar\"]\nTgtd countries: []\nMlwr families: [\"Vidar\"]\nAttack_ids: [\"T1113\", \"T1033\", \"T1056.001\", \"T1539\", \"T1497.001\", \"T1566.001\", \"T1082\", \"T1005\", \"T1140\", \"T1497.003\", \"T1555.003\", \"T1087\", \"T1083\", \"T1552.001\", \"T1057\", \"T1567.002\", \"T1555.004\", \"T1027.002\", \"T1071.001\", \"T1102.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344676",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f511754c-58c2-4571-bfb5-521ad6e5189c",
        "value": "lat.sodstreams.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344698",
        "to_ids": true,
        "type": "hostname",
        "uuid": "131b01ba-ae3e-41d8-9d89-d91dd099aa35",
        "value": "gor.emiraride.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344719",
        "to_ids": true,
        "type": "hostname",
        "uuid": "52a77900-8cb6-4340-aa6c-e08f7bc4b467",
        "value": "ctl.it-bd.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344740",
        "to_ids": true,
        "type": "hostname",
        "uuid": "818fef41-2c01-4c82-bf50-7098abf41a2d",
        "value": "gre.syslicense.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344761",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f6f454c4-0466-461a-9e80-2644314003a0",
        "value": "frr.ambil-disini.web.id",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344293",
        "to_ids": true,
        "type": "md5",
        "uuid": "5a3bbfe4-2b5b-4375-a50d-116f09c2c4cb",
        "value": "0b8af4afd26175ba818c0fdb4622bf14",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344294",
        "to_ids": true,
        "type": "md5",
        "uuid": "2f8c2370-d7db-4bb7-89d2-09cb59bc13bc",
        "value": "4e885b1a0c1d0636e940b4af20fdc8db",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784344295",
        "to_ids": true,
        "type": "md5",
        "uuid": "8403888d-4f9b-419d-adde-983f8f02bddb",
        "value": "7dd16d1018865e5e817c418f87e6be00",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-04-04T00:30:39+00:00",
        "last_seen": "2026-04-04T00:30:39+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784344782",
        "uuid": "83c5fd40-8ada-4558-90e9-9e4fe14b56c9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "md5",
            "timestamp": "1784344782",
            "to_ids": true,
            "type": "md5",
            "uuid": "0124b551-6707-4123-a620-ccb9a2cc7229",
            "value": "1bbf1e83eea55e70d59f0d633789011e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "sha1",
            "timestamp": "1784344289",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9e2d6f7f-bd9e-441c-b1d5-dce25584cf24",
            "value": "6eaf8f8cfc9161c6a287d0a1ce8ab436d14cfcad",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "sha256",
            "timestamp": "1784344289",
            "to_ids": true,
            "type": "sha256",
            "uuid": "306b7e8c-bb6d-4643-9ecb-57637e74e7c8",
            "value": "340820f7f4c97e3a2477bc99acf746e13b2c92719ebf5c9947a62eef7ec0dddb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "text",
            "timestamp": "1784337306",
            "to_ids": false,
            "type": "text",
            "uuid": "73aa6047-1bc5-41f8-83a0-ba5e83e0e861",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/DLLSideLoad.CA!MTB\nClamAV: None\nVT Total Detection: 50/74\nFirst Submission: 2026-04-04T00:30:39+00:00\nLast Submission: 2026-04-04T00:30:39+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784337306",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ed9d9a02-9a77-44a0-8fa9-eba126936e19",
            "value": "24576:IOmQFVYf2s04KceUItcLqOCIrIC23stVvnL8Lo/UGx8vLg+aeqG6WcRLm4:IOJFufnhucLPXVtVvYLoMGx8v8+aeOR"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784337306",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a0d054b0-6f8f-45b7-96f1-89eb60efbe89",
            "value": "2015368"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "vhash",
            "timestamp": "1784337306",
            "to_ids": true,
            "type": "vhash",
            "uuid": "843dcc12-d8b5-49e1-8590-eb6f33e0ad60",
            "value": "026096657d15551d15545az2e!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-04-04T00:30:39+00:00",
            "last_seen": "2026-04-04T00:30:39+00:00",
            "object_relation": "filename",
            "timestamp": "1784337306",
            "to_ids": true,
            "type": "filename",
            "uuid": "39e25880-4bfa-4ca4-ba9f-446b4a78bdb7",
            "value": "mknbp.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-03-11T10:20:35+00:00",
        "last_seen": "2026-03-11T10:20:35+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784344803",
        "uuid": "ac9d5588-b22a-475d-ab70-d68585a213bd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "md5",
            "timestamp": "1784344803",
            "to_ids": true,
            "type": "md5",
            "uuid": "ca5e6ff3-c52a-496f-b4e2-6485e3b4632b",
            "value": "2fba9ec34fdf4b1584dd9c69b9ec9393",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "sha1",
            "timestamp": "1784344291",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1d68a02f-bdf6-47d4-91f1-7769f5dc2869",
            "value": "87cb13512daff0f4e1783a59af449336b6e010e4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "sha256",
            "timestamp": "1784344291",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3c4bd6a3-8958-4682-91f1-37374c5e72b6",
            "value": "e8e7faa5e76dc773ffb1a7a6be36a47cc84e3ed45b928859b570332757cdb6cb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "text",
            "timestamp": "1784337328",
            "to_ids": false,
            "type": "text",
            "uuid": "a39582c4-d2ff-4733-bf29-f9efb8eb4b8c",
            "value": "Type Description: Win32 EXE\nOriginal name: acceptance.exe\nMicrosoft: Trojan:Win64/Vidar.AH!MTB\nClamAV: Win.Packed.Wingo-10059794-0\nVT Total Detection: 50/74\nFirst Submission: 2026-03-11T10:20:35+00:00\nLast Submission: 2026-03-11T10:20:35+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784337328",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6e62c12a-6e70-4a49-b5b5-5bcabff38be3",
            "value": "49152:PFO1ncdp9o5DT4/bg5gmiiuhwg0LxThGa:PFUcFI4jg5uOv9Th"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784337328",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ce3bd2db-e2cd-4764-a46c-6706364502b4",
            "value": "2482688"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "vhash",
            "timestamp": "1784337328",
            "to_ids": true,
            "type": "vhash",
            "uuid": "58827585-2c5c-423f-9506-2410ad357063",
            "value": "026096656d15551d15545az2f!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-11T10:20:35+00:00",
            "last_seen": "2026-03-11T10:20:35+00:00",
            "object_relation": "filename",
            "timestamp": "1784337328",
            "to_ids": true,
            "type": "filename",
            "uuid": "d87b3717-ea65-405a-8d18-e47161205e6c",
            "value": "acceptance.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-01-13T08:41:43+00:00",
        "last_seen": "2026-01-13T15:42:18+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784344824",
        "uuid": "bacb1e7c-dedc-4a6d-9dd2-df8398e9ac55",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "md5",
            "timestamp": "1784344824",
            "to_ids": true,
            "type": "md5",
            "uuid": "08512cb9-bc20-490c-bdb5-72b53affbbe1",
            "value": "536dd0b0f6dff75dc01869df9809df61",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "sha1",
            "timestamp": "1784344292",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e9f659a6-1596-475c-90e9-75f1bc50317e",
            "value": "bea391c7ef1665bc33712deee1109812fc606cc6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "sha256",
            "timestamp": "1784344292",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8ab5fefb-f7f7-4bd4-bfc4-46ebee989f3b",
            "value": "cff8b04f2c8ed63d37fd393ad23652a8b818e80b03851d7c1bd5842963a03348",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "text",
            "timestamp": "1784337370",
            "to_ids": false,
            "type": "text",
            "uuid": "24c39b9a-6486-4adf-be09-84ab168adadc",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Vidar.KK!MTB\nClamAV: None\nVT Total Detection: 52/74\nFirst Submission: 2026-01-13T08:41:43+00:00\nLast Submission: 2026-01-13T15:42:18+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784337370",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "363aa353-e674-4d2d-97e5-7445c8c53e5f",
            "value": "49152:UNgfstwa1K7rb/TnvO90d7HjmAFd4A64nsfJFvgLdvCwBB+hunYgMqzTK1e:0ldKAvevg"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784337370",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "71f3d53d-6905-4735-9b36-b073f4e95608",
            "value": "2032640"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "vhash",
            "timestamp": "1784337370",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c20d1316-1a0a-49f7-a844-c6a1785a3d40",
            "value": "026076656d1d1554551az28!z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-13T08:41:43+00:00",
            "last_seen": "2026-01-13T15:42:18+00:00",
            "object_relation": "filename",
            "timestamp": "1784337370",
            "to_ids": true,
            "type": "filename",
            "uuid": "e9e97185-8a25-4fb5-a6b6-5f5ecb22cc36",
            "value": "yax4byi1.exe"
          }
        ]
      }
    ]
  }
}