{
  "Event": {
    "analysis": "1",
    "date": "2026-07-16",
    "extends_uuid": "",
    "info": "[Threat Intel] Spirals: New Stealthy Ransomware Deployed Against Asian IT Company",
    "protected": false,
    "publish_timestamp": "1784588135",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784588134",
    "uuid": "4ba5f9af-3536-4096-80f7-84a80be1f17e",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#892644",
        "local": false,
        "name": "misp-galaxy:producer=\"Symantec\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#d74cce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#8efd0f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Account Manager - T1003.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#b2a633",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#657ac3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#07ff3c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#6d779a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#b596f0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Lateral Tool Transfer - T1570\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#370063",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c295b4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#fdcb58",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"somewhat-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"CloudFlare Tunnel\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"PSEXEC\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:tool=\"Chisel\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257224",
        "to_ids": false,
        "type": "link",
        "uuid": "de9dfbd1-37f4-4afc-8aab-d926ebb05bca",
        "value": "https://www.security.com/threat-intelligence/ransomware-spirals-extortion"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257224",
        "to_ids": false,
        "type": "text",
        "uuid": "bef67dbd-d248-4935-b493-65796f4764a8",
        "value": "A previously unseen ransomware family named Spirals was deployed in a double extortion attack against an IT services company in South Asia in June 2026. The Rust-based payload demonstrated sophisticated capabilities including defense evasion, encryption, lateral movement, and privilege escalation. Attackers gained initial access through a compromised internet-facing IIS web server via an ASP.NET web shell, moving rapidly to deploy ransomware within 24 hours. They established persistence using multiple tunneling tools, disabled endpoint security, harvested credentials through SAM hive and LSASS dumps, and deployed reverse-SOCKS proxies for covert command-and-control. The ransomware was distributed across the network using PsExec, encrypting files with AES-128 keys and threatening data publication within six days. The skilled execution suggests potential for wider campaigns, though the threat actor remains unidentified."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257224",
        "to_ids": false,
        "type": "text",
        "uuid": "79e7b02e-c53a-4f7e-9bed-2e7ff3c65839",
        "value": "Name: Spirals: New Stealthy Ransomware Deployed Against Asian IT Company\nAuthor: AlienVault\nAdversary: \nTags: [\"chisel\", \"web shell\", \"asp.net web shell\", \"cloudflare tunnel\", \"it services\", \"credential dumping\", \"revsocks\", \"south asia\", \"rust-based ransomware\", \"spirals\", \"lateral movement\", \"double extortion\"]\nTgtd countries: []\nMlwr families: [\"Spirals\", \"ASP.NET web shell\", \"revsocks\", \"Chisel\", \"Cloudflare Tunnel\"]\nAttack_ids: [\"T1548.002\", \"T1003.002\", \"T1036.005\", \"T1489\", \"T1135\", \"T1190\", \"T1572\", \"T1505.003\", \"T1136.001\", \"T1003.001\", \"T1083\", \"T1059.001\", \"T1562.001\", \"T1068\", \"T1486\", \"T1570\", \"T1059.003\", \"T1021.001\", \"T1090.001\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586084",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6a1c66c1-0892-497e-8f82-166323f9ff36",
        "value": "185.141.216.194",
        "Tag": [
          {
            "colour": "#b4135d",
            "local": false,
            "name": "asn:asn=\"26832\"",
            "relationship_type": ""
          },
          {
            "colour": "#b6e220",
            "local": false,
            "name": "asn:as-owner=\"RICAWEBSERVICES\"",
            "relationship_type": ""
          },
          {
            "colour": "#1273fb",
            "local": false,
            "name": "asn:as-country=\"CA\"",
            "relationship_type": ""
          },
          {
            "colour": "#813aa0",
            "local": false,
            "name": "misp-galaxy:country=\"canada\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585070",
        "to_ids": true,
        "type": "sha256",
        "uuid": "12d72cd9-c5c0-4b0f-b8e9-c86d37ed58a7",
        "value": "0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585071",
        "to_ids": true,
        "type": "sha256",
        "uuid": "87a325ca-c14f-4da6-9e32-cffbb15ad8fe",
        "value": "4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585072",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4ea55ffb-7b74-4278-81c5-eb7cbaa89ca5",
        "value": "7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585073",
        "to_ids": true,
        "type": "sha256",
        "uuid": "15d901d0-72b7-45be-9e43-16f857d44c5a",
        "value": "83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585074",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a9e3ed51-54c6-419d-a018-24014630896c",
        "value": "862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586105",
        "to_ids": true,
        "type": "url",
        "uuid": "3e1ba0dd-c3bd-4eeb-8b0a-8146cb984d1b",
        "value": "https://beta.padmin.com/mybenefits/Templates/cd.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586126",
        "to_ids": true,
        "type": "url",
        "uuid": "10d02a6c-845c-40db-a684-27fb2aed5d0f",
        "value": "https://computer.kplus.com/cd.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586148",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9e921a18-8cbf-47bb-a7ae-8bb6cfd8b740",
        "value": "beta.padmin.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586170",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a0a80244-60b1-4967-afd5-07fea07919c7",
        "value": "computer.kplus.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586191",
        "to_ids": true,
        "type": "url",
        "uuid": "539f5425-4bba-4a74-ab92-dd0e80e620d2",
        "value": "http://185.141.216.194/cd.jpg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784586212",
        "to_ids": true,
        "type": "url",
        "uuid": "a24fedbe-3835-46e4-a837-8d22ade6259d",
        "value": "http://185.141.216.194/cd.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2025-10-05T04:22:11+00:00",
        "last_seen": "2025-10-05T04:22:11+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784586233",
        "uuid": "04cc9eb9-a2dd-4b80-8791-187e6e1cab3f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "md5",
            "timestamp": "1784586233",
            "to_ids": true,
            "type": "md5",
            "uuid": "33426d94-eada-43af-bb87-c6b701c52699",
            "value": "26a15a6a9bea58e9ad2ada9a6c8606b5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585067",
            "to_ids": true,
            "type": "sha1",
            "uuid": "31360e7d-7861-4e48-b83e-a0a3170797f4",
            "value": "e25c56bd13eff7280e493bf58501c47891fe63bf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585067",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e36954e4-b6bb-44fb-adcd-a82a68ba902a",
            "value": "84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "text",
            "timestamp": "1784583567",
            "to_ids": false,
            "type": "text",
            "uuid": "26569c02-f776-4ab4-994f-390e642459ae",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: Win.Tool.Garble-10044180-0\nVT Total Detection: 44/74\nFirst Submission: 2025-10-05T04:22:11+00:00\nLast Submission: 2025-10-05T04:22:11+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784583567",
            "to_ids": false,
            "type": "datetime",
            "uuid": "f5f992d8-5384-4b8b-953e-4f4967c424ad",
            "value": "2025-09-13T18:16:34+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784583567",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "13b71040-129e-4323-a66d-624123baa5b6",
            "value": "98304:8PP93tclH0vR75du+xRhy+csVksLwRPNzABgJvu9kkLGm:8P4IhdcsSrdCB9knm"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784583567",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7db68eee-2da7-4d45-9498-c633a14737bf",
            "value": "18547712"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-10-05T04:22:11+00:00",
            "last_seen": "2025-10-05T04:22:11+00:00",
            "object_relation": "vhash",
            "timestamp": "1784583567",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5861529b-4466-4bf0-ba3e-8d43ebf08fe4",
            "value": "017086655d55551515541az2e!z"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2025-08-21T15:50:35+00:00",
        "last_seen": "2026-07-19T16:22:30+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784586254",
        "uuid": "80f16bd9-9076-4b77-9e33-dbf423b7edfb",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "md5",
            "timestamp": "1784586254",
            "to_ids": true,
            "type": "md5",
            "uuid": "4f25039a-3aa2-4009-9e18-a84a70a27105",
            "value": "16979576455e89192e5258e695b37d40",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585068",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7afb40ac-083f-402f-8be8-c28cbb124f4a",
            "value": "d3aade819ed8d8c1404805fb85dde6e36ad04e10",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585068",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3c694dfa-45d2-4294-9404-3e870cdb2bfa",
            "value": "b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 21/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "text",
            "timestamp": "1784583694",
            "to_ids": false,
            "type": "text",
            "uuid": "294d5ec4-fe2f-4bb2-9a67-06aaa8670964",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 9/74\nFirst Seen In The Wild: 2025-08-26T12:12:47+00:00\nFirst Submission: 2025-08-21T15:50:35+00:00\nLast Submission: 2026-07-19T16:22:30+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784583694",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a7413033-a4e5-403b-903a-76c07596c82f",
            "value": "196608:XeY8u/ip+g974qaFRWC6UWC3lkYsOs9i1qMBGdaMJx+KU3P6YgrB3gk9yn/uIPHs:Xxipx74q6ICLjlknOqis7r5Pl9YPs"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784583694",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3da0a117-98fe-44dd-b04f-525170ede69b",
            "value": "68513948"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "vhash",
            "timestamp": "1784583694",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7317a409-ac2b-4e56-80b6-883f5d6eff77",
            "value": "0671476d5555551c051d1az441a&z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-08-21T15:50:35+00:00",
            "last_seen": "2026-07-19T16:22:30+00:00",
            "object_relation": "filename",
            "timestamp": "1784583694",
            "to_ids": true,
            "type": "filename",
            "uuid": "ad9da91d-e2d8-472c-b829-7128390d3e65",
            "value": "cloudflared.exe"
          }
        ]
      }
    ]
  }
}