{
  "Event": {
    "analysis": "1",
    "date": "2026-06-22",
    "extends_uuid": "",
    "info": "[Threat Intel] From PostCSS Masquerading to Windows RAT",
    "protected": false,
    "publish_timestamp": "1782454634",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782454634",
    "uuid": "3dc106c4-03e5-4593-8ac5-75f4c01f6c59",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e51c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Process with Token - T1134.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782270022",
        "to_ids": false,
        "type": "link",
        "uuid": "19b401be-beaa-4754-8327-ce0235ad237e",
        "value": "https://research.jfrog.com/post/from-postcss-typosquat-to-windows-rat",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782270022",
        "to_ids": false,
        "type": "text",
        "uuid": "ee15a585-1044-4504-bd61-0229024c5f0d",
        "value": "A sophisticated supply chain attack leverages typosquatting of the legitimate postcss-selector-parser npm package, which receives over 150 million weekly downloads. Three malicious packages published by user 'abdrizak' masquerade as PostCSS utilities while delivering a multi-stage Windows RAT. The infection chain begins with encoded JavaScript that drops PowerShell scripts, which then download a bundled Python runtime containing Nuitka-compiled modules. The final payload implements comprehensive RAT capabilities including HTTP C2 communication with RC4 encryption, registry persistence, VM detection, remote shell execution, file transfer, and Chrome credential theft using DPAPI and app-bound decryption. The attack demonstrates how build tooling dependencies can serve as delivery mechanisms for sophisticated Windows malware targeting developer environments."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782270022",
        "to_ids": false,
        "type": "text",
        "uuid": "d7a324fa-d397-47f3-9371-81cf7c1dcfdb",
        "value": "Name: From PostCSS Masquerading to Windows RAT\nAuthor: AlienVault\nAdversary: \nTags: [\"rat\", \"multistage\", \"supply chain\", \"python\", \"typosquatting\", \"postcss\", \"nuitka\", \"credential theft\", \"npm\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1204.002\", \"T1573.001\", \"T1497.001\", \"T1082\", \"T1106\", \"T1005\", \"T1140\", \"T1555\", \"T1112\", \"T1555.003\", \"T1134.002\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1195.002\", \"T1027.002\", \"T1071.001\", \"T1059.005\", \"T1105\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447466",
        "to_ids": true,
        "type": "url",
        "uuid": "5b78eab6-3d89-4e0f-8a07-b649e4b883cf",
        "value": "http://nvidiadriver.net/verv1432/winpatch-xd7d.win",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447487",
        "to_ids": true,
        "type": "domain",
        "uuid": "a1a83741-20ea-4e8b-9268-4d436528bd42",
        "value": "nvidiadriver.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782447508",
        "to_ids": true,
        "type": "domain",
        "uuid": "00dc3894-8cc4-49fd-bddc-9cce90bf56d3",
        "value": "winpatch-xd7d.win",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447529",
        "uuid": "37e5c9b4-df67-48a4-831b-beef2a870a76",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447529",
            "to_ids": true,
            "type": "md5",
            "uuid": "843f517e-c216-41fd-a75f-9249a7649ef3",
            "value": "208166120775a11cb6680139ea0f3372",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445640",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7a8f73ad-9e5a-4ee7-a478-eefde70deebb",
            "value": "71c6cd37ddc0e5899174c72eefee8b224fd1f4bb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445640",
            "to_ids": true,
            "type": "sha256",
            "uuid": "169c46ba-a4bf-4c66-8d1e-63c22430ca75",
            "value": "c8075bbff748096e1c6a1ea0aa67bb6762fdd7551427a12425b35b94c1f1ecf2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445249",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d9cf43c3-077d-4af9-a0f2-896dfacb36b0",
            "value": "3072:ADTsZNRPHeOGcpv4yIYZrCYgha23p6klB1XvXgrhQzqDcdYkVLvEzVdcfReV6mwx:AqR1GcxTZria23wcPcm2NGReVvwPeE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445249",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ea60ce60-191d-4cdd-9e25-a3a70554fd0d",
            "value": "276480"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445249",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0cbe6554-38c0-4d33-b049-be58cf40d181",
            "value": "125066656d1555555az1a?z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782445249",
            "to_ids": true,
            "type": "filename",
            "uuid": "ec9d29fd-76c6-47ea-85d9-dd25c616fe45",
            "value": "command.cp310-win_amd64.pyd"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445249",
            "to_ids": false,
            "type": "text",
            "uuid": "d78f1329-ef69-41c5-b2a1-a2df9013e192",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:21/71\nFirst Submission:2026-06-04T05:29:32.000000+00:00\nLast Submission:2026-06-23T19:17:23.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447550",
        "uuid": "4de7589e-955c-42a6-b314-f8a16201f6f3",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447550",
            "to_ids": true,
            "type": "md5",
            "uuid": "bd0f584e-0bf6-408f-8f73-0786a004a9fd",
            "value": "4c1bdb2b045debf5b25e5be540ef99f0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445641",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f4b606d1-a1a0-4080-b7e0-381d42921a0d",
            "value": "7b1919c35da92cf5fd2583783dc9364fd11b69d2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445641",
            "to_ids": true,
            "type": "sha256",
            "uuid": "631ae80f-fc03-462d-ac0b-7378f5870d8b",
            "value": "50ffce607867d8fa8eaf6ef5cd25a3c0e7e4415e881b9e55c04a67bcddb74fdf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445271",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c753e0a2-0494-4343-9d29-9f8d9f331562",
            "value": "3072:sH/qvvIA8F6oSlWQJnnCJgSEUoYnzyfXPcdYkVLoAXYMtxk3:HvQo7VnCJNHeYo9"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445271",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2e6c754a-c9d1-4c26-a906-961e6f89dc6b",
            "value": "221184"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445271",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2162a0d1-ed34-41ed-bd3a-09444d633b0b",
            "value": "125066656d1555555az1a?z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782445271",
            "to_ids": true,
            "type": "filename",
            "uuid": "e99fde3f-a4a0-4dcd-8c07-94408897912e",
            "value": "api.cp310-win_amd64.pyd"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445271",
            "to_ids": false,
            "type": "text",
            "uuid": "57597f4d-304a-4993-8ddb-e15872ac8240",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:21/71\nFirst Submission:2026-06-04T05:29:32.000000+00:00\nLast Submission:2026-06-04T05:29:32.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447571",
        "uuid": "15fdfb86-155a-49d7-b0d4-04ffc68ea521",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447571",
            "to_ids": true,
            "type": "md5",
            "uuid": "5c072cf9-c2aa-47d6-a464-82e7b976049b",
            "value": "c2875e2f45e5f1dfa04463de53b3fa5a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445642",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a2b94ebc-1670-4ece-af3c-103f5c781c9f",
            "value": "965e3d19c89f12ef730120b84d9ee38755841447",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445642",
            "to_ids": true,
            "type": "sha256",
            "uuid": "48a3969a-112d-4d17-9a46-40ae0a6c68ac",
            "value": "164e322d6fbc62e254d73583acd7f39444c884d3f5e6a5d27db143fc25bc88b3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445293",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ef30d39e-45c3-4922-ab9a-4f100bc1d61f",
            "value": "3072:cpBx64JvdVARGP/rCimXvuBMcKORGQYg56AcdYkVLH65v/5PP7Wv:OBxllVAyrxmXvSF/gB6TG"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445293",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "84b6fe92-a6ab-49b5-9e1a-034337b1dccf",
            "value": "240640"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445293",
            "to_ids": true,
            "type": "vhash",
            "uuid": "811e23c1-3e64-4ec6-96bc-52d8797a1138",
            "value": "125066656d1555555az1a?z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782445293",
            "to_ids": true,
            "type": "filename",
            "uuid": "b0e1924a-f6d5-4a7a-a8dc-aa393092abc3",
            "value": "audiodriver.cp310-win_amd64.pyd"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445293",
            "to_ids": false,
            "type": "text",
            "uuid": "b720f78a-dcd5-4d8f-8e51-091008221b2e",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:22/71\nFirst Submission:2026-06-04T05:29:32.000000+00:00\nLast Submission:2026-06-23T19:18:32.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447593",
        "uuid": "2efdf94f-3c85-44c1-8817-a0ff21c9816a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447593",
            "to_ids": true,
            "type": "md5",
            "uuid": "5067cd90-80bd-4f50-953e-a627c1b020e3",
            "value": "c5207f87b9103634b4db6f120eb6172a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445643",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d39338d4-23e0-4fe0-8d59-ce7deaddd129",
            "value": "8e162d4fc8c5c74e16bfb4346f893cc7a71c2476",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445643",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1241388a-e390-4be3-a862-c99800f3a168",
            "value": "282b9bc318ad1234cbd1b86424b784299b8be31545802a7c6b751166b814b990",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445315",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a28dece3-af31-43ea-b995-96beb4e6ad07",
            "value": "3072:e4/ZonXnDzas/fz0WX4UDQ+GH8ttpsm0xD/6AcdYkVL1tbovc/:EXH/g04UDjGH+tpf6yx8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445315",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "352e53b6-889c-435f-9252-8e4e59ca3d34",
            "value": "221184"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445315",
            "to_ids": true,
            "type": "vhash",
            "uuid": "776664aa-b31e-4967-9f2a-c074f1d981f9",
            "value": "125066656d1555555az1a?z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782445315",
            "to_ids": true,
            "type": "filename",
            "uuid": "3021c3ad-3486-4383-bf18-a36a7cf2e7db",
            "value": "util.cp310-win_amd64.pyd"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445315",
            "to_ids": false,
            "type": "text",
            "uuid": "92c558bf-b6ab-4e3f-b359-3a17fe18f602",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:19/71\nFirst Submission:2026-06-04T05:29:32.000000+00:00\nLast Submission:2026-06-04T05:29:32.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447614",
        "uuid": "0a6d5559-ee24-4a50-bad5-55f9401f953b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447614",
            "to_ids": true,
            "type": "md5",
            "uuid": "2c96900d-a789-4570-be88-25fa4d540009",
            "value": "f189c338a5f2bc3cce06cee37c0b7522",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445644",
            "to_ids": true,
            "type": "sha1",
            "uuid": "04aa0c88-01af-46a4-8ccc-5fb044ca145d",
            "value": "2890d90edfc08fb4cfafe0d5fa2a9fb6800dedf5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445645",
            "to_ids": true,
            "type": "sha256",
            "uuid": "92c14724-f5c3-4967-b274-1fb84d7cb872",
            "value": "17832aa629524ef6e8d8d6e9b6b902a8d324b559e3c36dbd0e221ab1690be871",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445336",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5edacdd2-6006-4bd3-9738-a603d935d747",
            "value": "6144:/UgIXuy3RBj4q0X0SNlrGw29M9uod00bPvTSLV5R7:8+yBZ0kSn32S97d00bDS97"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445336",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7c7471c3-d692-4978-9a79-b577314965f1",
            "value": "316416"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445336",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7db17a48-48cc-47c8-a3be-ce0444ef6929",
            "value": "135066656d1555555az1a?z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782445336",
            "to_ids": true,
            "type": "filename",
            "uuid": "2ad1f6c0-b8d6-43eb-8a94-26308c32f5d5",
            "value": "auto.cp310-win_amd64.pyd"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445336",
            "to_ids": false,
            "type": "text",
            "uuid": "6f27dedd-d87f-4b4f-a913-9bbb726b5066",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:17/71\nFirst Submission:2026-06-04T05:29:32.000000+00:00\nLast Submission:2026-06-23T19:14:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447635",
        "uuid": "07f2df1d-00c6-470d-ae98-bc4278e2efdf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447635",
            "to_ids": true,
            "type": "md5",
            "uuid": "22e07ed1-16a0-4bbf-8821-228dc5b2495a",
            "value": "0c845a5ee504940bcff390f8e7d57030",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445645",
            "to_ids": true,
            "type": "sha1",
            "uuid": "94a5863c-4255-4e79-82c9-99e57710e9a7",
            "value": "9b9f5b19879a9f9a2a1680fc64079a464a97e32b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445645",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f9863f86-affd-47ea-84ee-e3a76bf3732a",
            "value": "f6669bd504ce6b0e303be7ee47f2ebbc062989c88c41f0a3f436044a24869798",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445358",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ec41f826-7855-4dce-afe9-acbbbb38161f",
            "value": "3072:ETm/iQVdjvy5EfSW6z/tZwPz+dAlcdYkVLGsppCN:ETmHd25WqVZKzk3pk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445358",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5f0888b9-fd59-4a90-b4d6-2949569a6f35",
            "value": "199680"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445358",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c2d3dfee-d6dd-417a-b3de-204ca544115b",
            "value": "115066656d1555555az1a?z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782445358",
            "to_ids": true,
            "type": "filename",
            "uuid": "03db2685-9190-4a36-909d-a3531cf8f405",
            "value": "config.cp310-win_amd64.pyd"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445358",
            "to_ids": false,
            "type": "text",
            "uuid": "3dda7adb-a07f-47c1-a67b-09a3402ab454",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:29/71\nFirst Submission:2026-06-04T05:29:32.000000+00:00\nLast Submission:2026-06-23T19:17:50.000000+00:00"
          }
        ]
      }
    ]
  }
}