{
  "Event": {
    "analysis": "1",
    "date": "2026-06-04",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign",
    "protected": false,
    "publish_timestamp": "1781219598",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1781219598",
    "uuid": "58309eb3-4a88-45c9-bb7d-8c4bd8d03bcc",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#f9b12b",
        "local": false,
        "name": "misp-galaxy:producer=\"Cyfirma\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#256f6a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL - T1574.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b33aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Subvert Trust Controls - T1553\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#fdd85e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Access Token Manipulation - T1134\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#5887a6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Japan\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780657213",
        "to_ids": false,
        "type": "link",
        "uuid": "f4b392d5-112a-4bfb-abbc-df671fcff74e",
        "value": "https://www.cyfirma.com/research/operation-taxshadow-multi-region-tax-phishing-in-memory-malware-campaign/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780657214",
        "to_ids": false,
        "type": "text",
        "uuid": "2489e0c2-47d6-45b4-b2e0-e46b5d8b418d",
        "value": "A sophisticated multi-stage malware campaign targets victims through tax-themed phishing emails impersonating Indian and Japanese government authorities. The operation leverages social engineering, fraudulent tax notifications, and trusted third-party email delivery services to distribute ZIP archives containing three staged payloads. The malware implements advanced evasion techniques including DLL Search Order Hijacking, API hooking, token manipulation, Mersenne Twister-based execution logic, COM callback execution, mutated RC4 encryption, and reflective PE loading. Execution occurs primarily in memory, significantly reducing forensic artifacts. The malware establishes persistent WebSocket-based command-and-control communication through HTTP protocol upgrades, allowing malicious traffic to blend with legitimate activity. Chinese-language artifacts were observed throughout the infrastructure and code, though attribution remains at moderate confidence. The campaign demonstrates characteristics of a mature, ..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780657214",
        "to_ids": false,
        "type": "text",
        "uuid": "69fb9ac8-2dbb-4906-9198-3c72f96f4b4a",
        "value": "Name: Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"websocket c2\", \"dll hijacking\", \"government impersonation\", \"multi-stage payload\", \"tax phishing\", \"in-memory execution\", \"reflective loading\", \"token manipulation\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\", \"Japan\"]\nMlwr families: []\nAttack_ids: [\"T1204.002\", \"T1566.002\", \"T1574.001\", \"T1082\", \"T1106\", \"T1140\", \"T1036\", \"T1055\", \"T1090\", \"T1059\", \"T1497\", \"T1027\", \"T1553\", \"T1573\", \"T1189\", \"T1134\", \"T1027.002\", \"T1071.001\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:12/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781215085",
        "to_ids": true,
        "type": "sha1",
        "uuid": "e1f4867c-e438-4b57-804f-30ceac20962c",
        "value": "87d4c8d022a298cefcb113040e69934d5be6a91c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216378",
        "to_ids": true,
        "type": "domain",
        "uuid": "ce77a9bb-ae00-4605-b699-33fd80d2b57d",
        "value": "appradarr.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216400",
        "to_ids": true,
        "type": "domain",
        "uuid": "bc967459-73f1-496d-bdb2-a1cd3f732ef9",
        "value": "asdqxcdsa.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216421",
        "to_ids": true,
        "type": "domain",
        "uuid": "e51333e2-5566-4f18-9ce8-2d314941d9ff",
        "value": "guhxmg.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216442",
        "to_ids": true,
        "type": "domain",
        "uuid": "5ce042e0-b30a-45a0-987e-647017c08637",
        "value": "mnb-ny.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216463",
        "to_ids": true,
        "type": "domain",
        "uuid": "064464b4-d2e4-4943-ab1d-d748025c599f",
        "value": "naiqja.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216485",
        "to_ids": true,
        "type": "domain",
        "uuid": "a3d8a56f-ccad-4cab-9b38-474f13ac2323",
        "value": "ws4962.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216506",
        "to_ids": true,
        "type": "domain",
        "uuid": "8ec688ca-c2c6-42dc-9626-5272affd428d",
        "value": "zh-welcome-1xbet.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216528",
        "to_ids": true,
        "type": "domain",
        "uuid": "d2e3edd5-296b-49b2-ade2-e48372bb48a4",
        "value": "zhengfu666.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216549",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9dd1ade1-61e0-4b89-8c3b-2a168adcd18e",
        "value": "d.pc-weide.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216571",
        "to_ids": true,
        "type": "hostname",
        "uuid": "12a8f1f8-27da-4d1c-ace5-fb85a92b094d",
        "value": "taxations.cn-web-okooo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216592",
        "to_ids": true,
        "type": "hostname",
        "uuid": "dfe7e358-c188-4eee-bd5a-171b195bb9a2",
        "value": "taxations.indiagov.it.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781216613",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "10a850c9-2ab3-4719-a17d-51580251e653",
        "value": "43.128.54.184",
        "Tag": [
          {
            "colour": "#dd7331",
            "local": false,
            "name": "asn:asn=\"132203\"",
            "relationship_type": ""
          },
          {
            "colour": "#723dcd",
            "local": false,
            "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "7",
        "timestamp": "1781212190",
        "uuid": "9480aab9-b014-4f65-8ee5-195391aa3b79",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1781212190",
            "to_ids": false,
            "type": "text",
            "uuid": "36da6041-c41b-496f-b3f1-7c6e135c1c87",
            "value": "Operation_Tax_Shadow_Malware_Campaign"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "comment",
            "timestamp": "1781212190",
            "to_ids": false,
            "type": "comment",
            "uuid": "821ec6d9-2266-4a9d-9265-53d4ac7aa0eb",
            "value": "Detection rule for phishing infrastructure and malware samples"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1781212190",
            "to_ids": true,
            "type": "yara",
            "uuid": "064e13ad-dde5-4ed5-a428-fe1e735d8d1c",
            "value": "import \u201chash\u201d\r\n\r\nrule Operation_Tax_Shadow_Malware_Campaign\r\n{\r\nmeta:\r\nauthor = \u201cCyfirma Research\u201d\r\ndescription = \u201cDetection rule for phishing infrastructure and malware samples\u201d\r\ndate = \u201c2026-05-29\u201d\r\nstrings:\r\n// Domains\r\n$d1 = \u201cguhxmg.com\u201d nocase\r\n$d2 = \u201cnaiqja.icu\u201d nocase\r\n$d3 = \u201czh-welcome-1xbet.com\u201d nocase\r\n$d4 = \u201cd.pc-weide.com\u201d nocase\r\n$d5 = \u201ctaxations.cn-web-okooo.com\u201d nocase\r\n$d6 = \u201ctaxations.indiagov.it.com\u201d nocase\r\n$d7 = \u201czhengfu666.com\u201d nocase\r\n$d8 = \u201casdqxcdsa.icu\u201d nocase\r\n$d9 = \u201cappradarr.cc\u201d nocase\r\n$d10 = \u201cws4962.com\u201d nocase\r\n// IP Address\r\n$ip1 = \u201c43.128.54.184\u201d\r\n\r\ncondition:\r\n// Match embedded infrastructure indicators\r\nany of ($d*) or\r\n$ip1 or\r\n\r\n// Match known malware hashes\r\nhash.sha256(0, filesize) == \u201c185b7a487316454da04e9cc0fe6eb370bb2955cf6096fe3e8c02c46f8989ba37\u201d or\r\nhash.sha256(0, filesize) == \u201c4c9061a07d667bf7dd6f597a43a8552af2f4277b7be06d6ea138abdb668d6a49\u201d or\r\nhash.sha256(0, filesize) == \u201c949acbe543fc244ffbc981ea169067da7c5792af3c3d19b2c31b3d7e19106880\u201d or\r\nhash.sha256(0, filesize) == \u201cbe31a63cad112723178289968ad6f93a576c5a7984099c42eec3521cdf6e5fc0\u201d or\r\nhash.sha256(0, filesize) == \u201c7d87a86dbd2379ef2516c99258137cd9c25ca19c48aeb096c5332c02fcbf16d0\u201d\r\n}"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216635",
        "uuid": "11e2b52d-faaa-4c57-bbf2-acb6352bf383",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216635",
            "to_ids": true,
            "type": "md5",
            "uuid": "b33efea2-c555-42ae-b49a-449ca754a551",
            "value": "3a8f6454927b8993aded75de0de2bd00",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215079",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6e1b0784-9e86-497c-b2d9-e8bd1a0802af",
            "value": "4650f7dc1a2ddbb6d73bf5bfd1b69dd6b79e0cdd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215079",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f0029722-cbb8-47f9-8a44-4b540b722741",
            "value": "185b7a487316454da04e9cc0fe6eb370bb2955cf6096fe3e8c02c46f8989ba37",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213817",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "307b87bd-5008-46bb-96a3-219390d83c77",
            "value": "3072:BMuCWBSJWOJ6wosiOjNiXfoZf+dm1WaicWQm:VHcJWOJ3QOjIXfHF+m"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213817",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5db15ac2-4a8b-4994-b441-ec69b0cb0d2c",
            "value": "151504"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213817",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3c76921d-2477-4928-81af-445dd4457ef8",
            "value": "015076655d155515155068z4d3z5hz2fz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213817",
            "to_ids": true,
            "type": "filename",
            "uuid": "c592f399-a164-42c3-8508-99f8aefc9794",
            "value": "SandboxieCrypto.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213817",
            "to_ids": false,
            "type": "text",
            "uuid": "a3b75eaa-5d75-4262-bf8d-4c2cbace1873",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:1/71\nFirst Submission:2024-10-03T15:46:01.000000+00:00\nLast Submission:2026-06-11T11:40:43.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216656",
        "uuid": "d62c9f7a-10d4-4b7a-9c84-f5c35de10940",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216656",
            "to_ids": true,
            "type": "md5",
            "uuid": "9c65d50c-2885-4835-88bd-429be9792688",
            "value": "b498256cb086a6962077cdd6d2f65327",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215079",
            "to_ids": true,
            "type": "sha1",
            "uuid": "eca37cb3-7764-4919-b2d6-6370c892b776",
            "value": "89570f6a7e71309f6f565f5dc54f65489d4dd3f7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215079",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a862a294-1b9f-4a4e-b238-969654c2d12e",
            "value": "949acbe543fc244ffbc981ea169067da7c5792af3c3d19b2c31b3d7e19106880",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213839",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e8fd982d-e392-4cea-bb31-8599565ce4c2",
            "value": "6144:7AG/vNk3F+OF8slkEpEce0cWCjlINwa09QZ2/f0U:7AuvN0Fe8kEpEcMWCjlIN6HN"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213839",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "48f9279b-5a22-41dc-ae9d-ba6de9f05174",
            "value": "298544"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213839",
            "to_ids": true,
            "type": "filename",
            "uuid": "985156d6-3f57-4fb0-b3b5-afcde8585552",
            "value": "SbieDll.bin"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213839",
            "to_ids": false,
            "type": "text",
            "uuid": "3f754db6-753a-463c-9091-db2f002dd9af",
            "value": "Type Description: PGP Security Key\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:28/61\nFirst Submission:2026-05-19T07:39:40.000000+00:00\nLast Submission:2026-05-19T07:39:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216678",
        "uuid": "137f5ab6-05ff-4fe8-ad17-560a6f86b973",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216678",
            "to_ids": true,
            "type": "md5",
            "uuid": "4d8c4786-3b3e-4540-a08d-7d8d56110321",
            "value": "e83ff54e58f0b295a392c7fc39a7d0de",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215081",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6a9ea47d-072a-4bf5-bee2-eeef3158a0f0",
            "value": "0528c3c229ea9ae35ee2e1575d82a76e029067bd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215081",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6ad4a854-80b4-4b8f-9553-65e47a95ad2c",
            "value": "822eac6303b65db4704f8737dc43b6c577bb7f96ce91585acec07cf6556a3af2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213861",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "05caaea9-33e3-41de-b589-6a17c945d4aa",
            "value": "24576:ZrBiD1YHZ7ilfM24woCLQkbCqgPrtqPHNSwAor17s47NXwI+krfVtPKvBuhNC0TD:Z1iD1MZCM2HgMhAC1l7NXdEwC0TD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213861",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "697f1a98-f552-4412-9002-e98c899a2b4a",
            "value": "2451457"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213861",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4e675ab3-e386-4074-a80b-37e3fea6bfd9",
            "value": "12606e6e1e5e5e5e6.z2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213861",
            "to_ids": true,
            "type": "filename",
            "uuid": "deb8730d-d8b8-4d9b-b4f3-58853a1d0c27",
            "value": "SoftMgr"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213861",
            "to_ids": false,
            "type": "text",
            "uuid": "c5d03f57-0099-42c4-a237-b21a5f9a1095",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Phonzy.A!ml\nVT Total Detection:51/71\nFirst Submission:2026-05-29T18:08:45.000000+00:00\nLast Submission:2026-05-29T18:08:45.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216699",
        "uuid": "faec5d8a-1320-402b-ab09-808e9591a98c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216699",
            "to_ids": true,
            "type": "md5",
            "uuid": "f99c88c5-60ad-4e10-8d58-773d29a8903e",
            "value": "76db1030d3f1463cb10160b29d183172",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215082",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c436b959-2452-431b-9676-473d6b6643f6",
            "value": "bd68549321832459e7d6c23e289950017f03af01",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215082",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a7e5012b-c962-44a5-bdea-244761d72830",
            "value": "4c9061a07d667bf7dd6f597a43a8552af2f4277b7be06d6ea138abdb668d6a49",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213883",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "146c6cf2-22c6-4e4b-ab2b-a26f9ca7d756",
            "value": "768:93hnwFdnBfpMkDdOIdjNjnOncrMra5agta:9dwXTNOIvjCra4gta"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213883",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2a463dfc-13bc-4016-86cd-1a8a29520c1d",
            "value": "133120"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213883",
            "to_ids": true,
            "type": "vhash",
            "uuid": "332d7ecd-fd10-4f50-95c1-9ddaad0b6578",
            "value": "11503e0f1d1bz3015z1uz2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213883",
            "to_ids": true,
            "type": "filename",
            "uuid": "e8ce2a74-6aaa-4f87-875c-e583b2441958",
            "value": "SbieDll.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213883",
            "to_ids": false,
            "type": "text",
            "uuid": "17ba08ad-5aa8-4f0d-97a9-894b1118b946",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:41/71\nFirst Submission:2026-05-20T10:23:06.000000+00:00\nLast Submission:2026-05-20T10:23:06.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216720",
        "uuid": "45ae0fdc-c092-497d-a9b7-be0e24eb5614",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216720",
            "to_ids": true,
            "type": "md5",
            "uuid": "d4e26d19-390a-423e-b57e-bc77944b4174",
            "value": "a8281063a3b62bb27520fe889f8043ba",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215083",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bb1b2ed0-d7ce-4350-902a-032a883b4ca1",
            "value": "2e63e05420b467b7234a3bd7be4daf944188b589",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215083",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d839ec2e-8b55-4985-b38e-430ae5de0de1",
            "value": "7d87a86dbd2379ef2516c99258137cd9c25ca19c48aeb096c5332c02fcbf16d0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213904",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9017187e-479b-475c-998f-118e6567b2e7",
            "value": "24576:m9BiD1YHZ7ilfM24woCLQkbCqgPrtqPHNSwAor17s47NXwI+krfVtPKvBuhNC0TD:mLiD1MZCM2HgMhAC1l7NXdEwC0TD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213904",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "cf318d4f-8e62-4a18-ae15-699696767f2c",
            "value": "2452481"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213904",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c2b93696-a29d-4f97-8fbb-56841271b3e2",
            "value": "12606e6e1e5e5e5e6.z2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213904",
            "to_ids": true,
            "type": "filename",
            "uuid": "8290f91b-4494-41a5-a3d8-b85ca14cb6ad",
            "value": "upx.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213904",
            "to_ids": false,
            "type": "text",
            "uuid": "1b90b87e-7c83-4f5d-a2aa-1d35ac682b62",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:51/71\nFirst Submission:2026-05-20T10:23:07.000000+00:00\nLast Submission:2026-05-20T10:23:07.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781216742",
        "uuid": "be7b64f2-ca5b-4e4b-829a-f7e398205bb2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781216742",
            "to_ids": true,
            "type": "md5",
            "uuid": "24f78c03-4242-41f8-8a94-58d6ee7d011c",
            "value": "c7b74b06cebeb8406de4e38b8f45f886",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781215084",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5c3b6985-c619-4f5a-afe2-3e094671f7ea",
            "value": "1e890e88daf96323922422242b6d607e0da4ebde",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781215084",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0a221e69-4a7e-45d1-b921-ec2bbedb24b4",
            "value": "be31a63cad112723178289968ad6f93a576c5a7984099c42eec3521cdf6e5fc0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781213927",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "77d25bd0-e7da-41b0-85a2-55d760571e59",
            "value": "49152:Dnw80RnwVLiD1MZCM2HgMhAC1l7NXdEwC0TDy:Dnw8anws3D1ACy"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781213927",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6f78d3ef-5d48-47ca-9830-8fe0cd2e8e8b",
            "value": "3491840"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781213927",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0203cc52-e706-492c-983b-7fde87c20b59",
            "value": "c0ef486598be1ee2f5a6faecfb43d5af"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781213927",
            "to_ids": true,
            "type": "filename",
            "uuid": "e85f048c-4a7a-46fa-90f0-888c8125fbea",
            "value": "localfile~"
          },
          {
            "category": "Other",
            "comment": "Checked: 12/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781213927",
            "to_ids": false,
            "type": "text",
            "uuid": "b17900d3-cbad-443e-83b3-7919a50ddcd0",
            "value": "Type Description: TAR\nMicrosoft: None\nVT Total Detection:40/63\nFirst Submission:2026-05-20T10:22:27.000000+00:00\nLast Submission:2026-05-20T10:22:27.000000+00:00"
          }
        ]
      }
    ]
  }
}