{
  "Event": {
    "analysis": "1",
    "date": "2026-06-01",
    "extends_uuid": "",
    "info": "[Threat Intel] FSB\u2019s matryoshka #1/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaPhish and GammaWorm",
    "protected": false,
    "publish_timestamp": "1780521475",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780521475",
    "uuid": "4b07e628-47c4-46c6-a774-3c500bd9f831",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#d3e17d",
        "local": false,
        "name": "misp-galaxy:producer=\"Sekoia\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#3e2e74",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Replication Through Removable Media - T1091\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#82a529",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Shortcut Modification - T1547.009\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#cfba47",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8bde06",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"NTFS File Attributes - T1564.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e4d611",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ukraine\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": false,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780398016",
        "to_ids": false,
        "type": "link",
        "uuid": "1d610b5f-86e7-4447-bd46-b365afbed27a",
        "value": "https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780398016",
        "to_ids": false,
        "type": "text",
        "uuid": "ad36970a-39cf-456c-abbe-9d29db007a22",
        "value": "Gamaredon, a cyberespionage group operated by Russia's FSB, conducts long-term intrusion operations targeting Ukrainian government, military, and critical infrastructure. This analysis documents their 2026 infection chain, which uses HTML smuggling with weaponized xHTML files delivering RAR archives that exploit CVE-2025-8088 to extract HTA files into Windows Startup directories. The chain deploys GammaPhish for initial access, GammaLoad for staging, GammaWorm for propagation via USB and network drives, and GammaSteal for exfiltration. The architecture is nearly fileless, leveraging NTFS Alternate Data Streams to conceal modules and using Dead Drop Resolvers on legitimate platforms like Telegram and Cloudflare for C2 infrastructure. Every stage functions as an independent backdoor capable of executing arbitrary VBScript, representing a shift from their historical Pteranodon framework to a modular ecosystem designed for persistent espionage."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780398016",
        "to_ids": false,
        "type": "text",
        "uuid": "edb9ca4f-0bc5-42bf-ada3-751a7b75e290",
        "value": "Name: FSB\u2019s matryoshka #1/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaPhish and GammaWorm\nAuthor: AlienVault\nAdversary: Gamaredon\nTags: [\"gammaworm\", \"gammaload\", \"pteranodon\", \"gamaredon\", \"gammasteal\", \"gammaphish\", \"fsb\"]\nTgtd countries: [\"Ukraine\"]\nMlwr families: [\"GammaPhish\", \"GammaLoad\", \"GammaWorm\", \"GammaSteal\", \"Pteranodon - S0147\", \"Pterodo\"]\nAttack_ids: [\"T1053.005\", \"T1132.001\", \"T1204.002\", \"T1566.001\", \"T1082\", \"T1091\", \"T1005\", \"T1547.009\", \"T1112\", \"T1020\", \"T1547.001\", \"T1027\", \"T1573\", \"T1102.002\", \"T1071.001\", \"T1059.005\", \"T1204.001\", \"T1564.004\", \"T1102.001\"]\nIndustries: [\"Government\", \"Defense\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780398016",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "c9550290-3ca6-4006-99b3-9e97c491b32c",
        "value": "Gamaredon"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780398016",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "80cbf833-1572-453b-9fd3-c46cfa063758",
        "value": "CVE-2018-20250"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780398016",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "6f67d2d4-cdaf-4f8a-aa90-a77ee345c7e6",
        "value": "CVE-2025-8088"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500729",
        "to_ids": true,
        "type": "hostname",
        "uuid": "deb80226-07b1-4d65-ade5-1a9fcf39ef4b",
        "value": "iiwdsxwamylbwwsoyrmj.supabase.co",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500750",
        "to_ids": true,
        "type": "domain",
        "uuid": "fd856de4-2718-4040-95b5-b10f200e7365",
        "value": "quitethepastry.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "GammaWorm No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498057",
        "to_ids": true,
        "type": "md5",
        "uuid": "04d25d6b-af62-42a9-bc10-211153d5c81f",
        "value": "8e1624d110c090ff57d4b493a9107c66",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500772",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f636a8a9-1bd2-4448-a6db-f752a25c9d29",
        "value": "104.194.140.6",
        "Tag": [
          {
            "colour": "#9d292c",
            "local": false,
            "name": "asn:asn=\"198983\"",
            "relationship_type": ""
          },
          {
            "colour": "#88843e",
            "local": false,
            "name": "asn:as-owner=\"TORNADODATACENTER\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500793",
        "to_ids": true,
        "type": "url",
        "uuid": "8e8df51b-82ef-4aa9-9f9d-537b77042285",
        "value": "https://efficiency-planes-emotions-fascinating.trycloudflare.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500814",
        "to_ids": true,
        "type": "url",
        "uuid": "0596ee3c-2e1b-4098-bc48-ba2fbdba85af",
        "value": "https://moment-cat-qld-place.trycloudflare.com/sylvilagus",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500835",
        "to_ids": true,
        "type": "url",
        "uuid": "2b91a80b-60cb-49ac-bf37-46ca669aa98b",
        "value": "https://quitethepastry.ru",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500856",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d0ce01ad-c7c3-420c-b171-bbcaf5cd7374",
        "value": "efficiency-planes-emotions-fascinating.trycloudflare.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500877",
        "to_ids": true,
        "type": "hostname",
        "uuid": "aec38ef4-9f66-46af-b173-492cc00b090f",
        "value": "moment-cat-qld-place.trycloudflare.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead Drop Resolvers (DDR)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500898",
        "to_ids": true,
        "type": "url",
        "uuid": "61eb5595-9361-4165-9fde-01f86825baef",
        "value": "https://graph.org/kyjfkyr-12-06",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead Drop Resolvers (DDR)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500919",
        "to_ids": true,
        "type": "url",
        "uuid": "2ec1bf28-baa2-4446-b67c-20d653cbaeb4",
        "value": "https://bold.zsjtn41091.workers.dev",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead Drop Resolvers (DDR)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500940",
        "to_ids": true,
        "type": "url",
        "uuid": "cac24986-ecae-4f08-b1e3-58ce1b5e651b",
        "value": "https://teletype.in/@myrain/Xh1Lta2Ccro",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead Drop Resolvers (DDR)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500961",
        "to_ids": true,
        "type": "url",
        "uuid": "e715ca12-a4db-4518-9faf-3176eb8c4257",
        "value": "https://telegra.ph/f8bfl6sp-01-02",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead Drop Resolvers (DDR)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780500982",
        "to_ids": true,
        "type": "url",
        "uuid": "bebf3744-e3d1-4b63-a5ff-c731633791e3",
        "value": "https:/t.me/s/teotori",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead Drop Resolvers (DDR)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501004",
        "to_ids": true,
        "type": "url",
        "uuid": "82b92f5b-0886-4d94-956c-d17f78d20575",
        "value": "https://www.telegram.me/s/oberfarir",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501025",
        "uuid": "b05c7f8d-e023-42e2-94d1-811179e7792c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "GammaPhish",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501025",
            "to_ids": true,
            "type": "md5",
            "uuid": "f4698e16-d954-42b5-9561-e2ca5a5e82f4",
            "value": "1794369214b7f62e70a0485e61335c61",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "GammaPhish",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498056",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0a81a971-032f-480b-873f-95999e48a467",
            "value": "ef68d475b7f4946f9c947a48e0ecff9c82dd4d8b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "GammaPhish",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498056",
            "to_ids": true,
            "type": "sha256",
            "uuid": "aa71ca9a-6fa0-4dd4-a2f1-a9397c320107",
            "value": "31e81f318b59961dc72a1140f5a72c7a04576ee5f3b45ee6dcafff8c3bc52a59",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497345",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "75ec41f9-7473-479d-a4f7-c2364f7b8e5b",
            "value": "384:FsKsIb/aJzW9WlT9DZ61DJRX5gXmC2BEAw650fwCYAz+LYo:FT7oz9EJqWEAh57PAqMo"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497345",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7ad6eda3-fcd4-4c00-9d67-72a9744cd1b4",
            "value": "16377"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497345",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d434f2e0-36a6-43a7-9fb0-6289ddc1fd51",
            "value": "c61ec1c4fd843a9a343ed29bd2660625"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497345",
            "to_ids": true,
            "type": "filename",
            "uuid": "9dabba40-bc3f-4db4-8fde-eb0f5dafc469",
            "value": "1_13_5_1691_09.12.2025.xhtml"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497345",
            "to_ids": false,
            "type": "text",
            "uuid": "2f47d026-b542-4f73-a248-6c045bd34c4f",
            "value": "GammaPhish\r\nType Description: HTML\nMicrosoft: None\nVT Total Detection:19/62\nFirst Submission:2025-12-10T11:20:12.000000+00:00\nLast Submission:2025-12-10T11:22:49.000000+00:00"
          }
        ]
      }
    ]
  }
}