{
  "Event": {
    "analysis": "1",
    "date": "2026-07-13",
    "extends_uuid": "",
    "info": "[Threat Intel] One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators",
    "protected": false,
    "publish_timestamp": "1784409327",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784409327",
    "uuid": "5a479407-3df8-4530-8e5d-65850c140fcd",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#3909cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "relationship_type": ""
      },
      {
        "colour": "#d4fd6f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"",
        "relationship_type": ""
      },
      {
        "colour": "#e00500",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"",
        "relationship_type": ""
      },
      {
        "colour": "#280b0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#492c65",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credential Stuffing - T1110.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#549eb8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"ARP Cache Poisoning - T1557.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#b990dd",
        "local": false,
        "name": "misp-galaxy:target-information=\"Australia\"",
        "relationship_type": ""
      },
      {
        "colour": "#c94db5",
        "local": false,
        "name": "misp-galaxy:target-information=\"Brazil\"",
        "relationship_type": ""
      },
      {
        "colour": "#1faf16",
        "local": false,
        "name": "misp-galaxy:target-information=\"Canada\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#c180fb",
        "local": false,
        "name": "misp-galaxy:target-information=\"Norway\"",
        "relationship_type": ""
      },
      {
        "colour": "#809a25",
        "local": false,
        "name": "misp-galaxy:target-information=\"Poland\"",
        "relationship_type": ""
      },
      {
        "colour": "#7dbb86",
        "local": false,
        "name": "misp-galaxy:target-information=\"Singapore\"",
        "relationship_type": ""
      },
      {
        "colour": "#c62adc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Slovenia\"",
        "relationship_type": ""
      },
      {
        "colour": "#f439e5",
        "local": false,
        "name": "misp-galaxy:target-information=\"Spain\"",
        "relationship_type": ""
      },
      {
        "colour": "#e6caf2",
        "local": false,
        "name": "misp-galaxy:target-information=\"Switzerland\"",
        "relationship_type": ""
      },
      {
        "colour": "#ce59f1",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Kingdom\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"Kraken\"",
        "relationship_type": ""
      },
      {
        "colour": "#78cd12",
        "local": false,
        "name": "misp-galaxy:target-information=\"Egypt\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AsyncRAT\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Evilginx\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"CloudFlare Tunnel\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"GetScreen\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"Itarian\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"ScreenConnect\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"SimpleHelp\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"SuperOps\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"Xeox\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940407",
        "to_ids": false,
        "type": "link",
        "uuid": "609fe0a9-5d6e-4019-a615-05a15bd97a50",
        "value": "https://blog.lexfo.fr/opendir-to-phishing-operator.html"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940407",
        "to_ids": false,
        "type": "text",
        "uuid": "0b773f2e-55ab-4f10-9030-f7b46990968f",
        "value": "A misconfigured Python HTTP server on a Budapest VPS exposed the complete operational infrastructure of three distinct phishing operators. The investigation uncovered codemado, an Egyptian threat actor operating since 2018, running a full AiTM platform with custom tools including MaDoO Blaster; saroula01, deploying OAuth Device Code Flow attacks that accumulated 218 victims across 12 countries over a year; and mail-argenta, a Nigerian operator identified through infostealer logs containing his own credentials. All three actors leveraged customized Evilginx forks and AI-assisted development to build MFA-bypass infrastructure from public GitHub repositories. The campaigns targeted Microsoft 365 accounts primarily, with codemado maintaining ties to RockyBelling's \"The Quarry\" cybercrime ecosystem. The exposed server contained phishing configurations, credential logs, RMM installers, combolists, and Telegram session files, revealing sustained operations from at least January 2025 through May 2026."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940407",
        "to_ids": false,
        "type": "text",
        "uuid": "84cb5cc9-7f9d-47ef-8fc7-257a9e199916",
        "value": "Name: One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators\nAuthor: AlienVault\nAdversary: codemado\nTags: [\"madoo blaster\", \"asyncrat\", \"rmm tools\", \"oauth abuse\", \"evilginx\", \"aitm\", \"phishing infrastructure\"]\nTgtd countries: [\"United States of America\", \"Australia\", \"Brazil\", \"Canada\", \"France\", \"Norway\", \"Poland\", \"Singapore\", \"Slovenia\", \"Spain\", \"Switzerland\", \"United Kingdom of Great Britain and Northern Ireland\"]\nMlwr families: [\"AsyncRAT\", \"MaDoO Blaster\", \"Evilginx\"]\nAttack_ids: [\"T1539\", \"T1114\", \"T1566.002\", \"T1119\", \"T1562\", \"T1219\", \"T1090.002\", \"T1102\", \"T1528\", \"T1110.004\", \"T1027\", \"T1557.002\"]\nIndustries: [\"Finance\", \"Technology\", \"Government\", \"Healthcare\", \"Construction\", \"Retail\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940407",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "516814db-1d95-4005-b0ed-559044c54647",
        "value": "codemado"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381187",
        "to_ids": true,
        "type": "domain",
        "uuid": "a4204d59-12d5-4ca3-9ca0-e241b67258f0",
        "value": "picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381208",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "23922769-4ea4-4890-add9-ecefaa3ab70e",
        "value": "83.136.211.85",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381229",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "09c74800-9abf-4a91-a53e-5558808512ce",
        "value": "188.227.196.240",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381250",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b760245c-5ae5-4a75-b83e-3d867f76d990",
        "value": "hrvetbr.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381271",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57870ee1-689b-4adc-aedf-0779ff4603c6",
        "value": "hervw.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381292",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4ae578ab-503d-4fd4-a717-a61d4ab7a667",
        "value": "cdn.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381314",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1add32a4-8f60-45a8-a093-a0896f0b84cc",
        "value": "hervw2.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381335",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ac15c8c6-56b8-4c99-b17d-1b9a845d21eb",
        "value": "ewfweo.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381357",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c01a9ec9-2419-466c-8c42-0d6ee9f25baf",
        "value": "htejre.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381378",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ef2abdfc-f6b4-457a-8953-44c44e57bdaf",
        "value": "sso.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381399",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3fe417e5-4b14-4b48-8bb1-9b2a2110f7e7",
        "value": "jrhte.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381420",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4e597a32-d0e8-4242-a36c-9e44ff67d0d2",
        "value": "events.api.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381441",
        "to_ids": true,
        "type": "hostname",
        "uuid": "61aa9358-e28d-424e-b745-8508af934622",
        "value": "mejeff.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381462",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9bda2139-76e6-40b3-a7b4-c058f5b852fd",
        "value": "hvr34gr.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381483",
        "to_ids": true,
        "type": "hostname",
        "uuid": "08d7bf17-7a7b-4bb7-a826-07cf417762a1",
        "value": "img1.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784409316",
        "to_ids": true,
        "type": "sha1",
        "uuid": "9f9df47f-7c61-4b33-a26d-622e89a89e54",
        "value": "2ea61cdead470f570586f513e22d43d787befec6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784409318",
        "to_ids": true,
        "type": "sha1",
        "uuid": "25d68eb8-b4fc-4946-a0cb-e55bb9e2051f",
        "value": "35f23dfb4135d4cd38a6a29e64d79191d166344d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784409320",
        "to_ids": true,
        "type": "sha1",
        "uuid": "2dc63a98-70de-41bf-b263-c6db34257492",
        "value": "6a4cb1c75e1c59bbd4fbc4667f4c3bb5a74fe965",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784409322",
        "to_ids": true,
        "type": "sha1",
        "uuid": "866bd468-668d-444b-b751-01972a93de72",
        "value": "cf3cbf93adf43d50618c88705857d3adb123ed24",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784409324",
        "to_ids": true,
        "type": "sha1",
        "uuid": "9c782f9e-09ac-4789-9366-2a9fbe049937",
        "value": "eb8ede7598220dbef28953dc7df2e5418d52fa36",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784409327",
        "to_ids": true,
        "type": "sha1",
        "uuid": "4ff8d5b3-deb3-40ba-9173-47d14ed0d4a9",
        "value": "f496736e2d2344de7963d4f722381f03227ec452",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381505",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f36eacc9-cbcd-4e45-a15a-9c2a0542433f",
        "value": "216.180.245.166",
        "Tag": [
          {
            "colour": "#15dbfe",
            "local": false,
            "name": "asn:asn=\"212238\"",
            "relationship_type": ""
          },
          {
            "colour": "#1f1556",
            "local": false,
            "name": "asn:as-owner=\"CDNEXT\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381526",
        "to_ids": true,
        "type": "url",
        "uuid": "ee26c564-e7d9-4b61-9500-e17bff70e9c6",
        "value": "http://account.romnor.ca/go",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381547",
        "to_ids": true,
        "type": "url",
        "uuid": "ff1f726c-b72f-496d-b1b5-512d50084fa3",
        "value": "http://briefing.romnor.ca/go",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381568",
        "to_ids": true,
        "type": "url",
        "uuid": "0799f1ae-cab6-4bab-9b81-d065e7ac6263",
        "value": "http://download.romnor.ca/go",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381589",
        "to_ids": true,
        "type": "url",
        "uuid": "87aa77cc-7b86-4019-b021-848f3f7afe46",
        "value": "http://share.romnor.ca/go",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381610",
        "to_ids": true,
        "type": "url",
        "uuid": "f92d9371-e8dc-4f24-85ef-620b8b5d14a4",
        "value": "http://sign.romnor.ca/go",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381632",
        "to_ids": true,
        "type": "url",
        "uuid": "ed82fe20-a695-4d9d-b5e9-c6c5f1ac8a83",
        "value": "http://team.romnor.ca/go",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381653",
        "to_ids": true,
        "type": "url",
        "uuid": "f8706cae-6a7a-4ad1-a922-915c11886d9f",
        "value": "http://verify.picis.net/verify-human",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381674",
        "to_ids": true,
        "type": "domain",
        "uuid": "849e1d2f-b12c-4433-a5fd-b51e6fd9d2e2",
        "value": "queeenspropertyservices.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381695",
        "to_ids": true,
        "type": "domain",
        "uuid": "485966a2-8478-40d1-8c71-95fd43c116f2",
        "value": "romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381716",
        "to_ids": true,
        "type": "domain",
        "uuid": "e6df52fe-97c6-4d8c-977e-ec866ec3508e",
        "value": "simple.run",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381737",
        "to_ids": true,
        "type": "hostname",
        "uuid": "23e4375f-6f5e-4736-bce1-7fed1f06f151",
        "value": "account.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381758",
        "to_ids": true,
        "type": "hostname",
        "uuid": "64799a4e-35e8-4c5e-8254-c5753cde43e1",
        "value": "account.romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381780",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e9fd947c-99ec-43e6-9142-cd209d0be436",
        "value": "accounts.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381801",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9602f27a-6b4f-4133-b76a-71ce4f1ccf6d",
        "value": "agent01.xeox.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381822",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2aa37e49-ec78-463a-8c25-7cd2be7dc574",
        "value": "b8c4u.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381844",
        "to_ids": true,
        "type": "hostname",
        "uuid": "09297773-2be5-4262-abae-0de1b6dbd8a8",
        "value": "billing.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381865",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d5b3942-efbe-434b-8259-3d25ffdaa782",
        "value": "briefing.romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381886",
        "to_ids": true,
        "type": "hostname",
        "uuid": "324473d3-8a9f-4351-8bd2-70d506332efc",
        "value": "c9x3h.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381907",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1582bc05-2ab3-4ef6-8129-2e5d57296a96",
        "value": "download.romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381929",
        "to_ids": true,
        "type": "hostname",
        "uuid": "673bd7f3-f5cd-4be5-89ba-805a338484dd",
        "value": "e2a6m.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381950",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2b7ad847-7a9d-40a5-90b6-b0a091d1ddcf",
        "value": "f3d9v.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381972",
        "to_ids": true,
        "type": "hostname",
        "uuid": "bb487da7-12e3-40c8-b7d0-fa56b1bad237",
        "value": "g7k1w.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784381994",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9fe2da07-10c6-43db-8231-66dc1d38074f",
        "value": "gui.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382015",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b7c26d31-a5b5-4ee4-8bf3-0066909ab150",
        "value": "h6y2s.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382036",
        "to_ids": true,
        "type": "hostname",
        "uuid": "21cd7a39-0ab3-447d-9ef1-42fc9dc950f9",
        "value": "hcwdg.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382057",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d9c0de64-3c3c-4f04-aed8-57a2917bd0d4",
        "value": "hnrvrve.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382078",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fc9b38df-6fe1-40a8-b506-8bc9af643f39",
        "value": "hterw.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382100",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e94f1cc9-020c-48cd-84c6-9c279007e5f8",
        "value": "img6.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382121",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b490700c-5b67-42a9-b9a8-373137d87571",
        "value": "k9m2x.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382142",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2871470a-a1cb-4184-aa4f-75df74431012",
        "value": "l5p0n.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382164",
        "to_ids": true,
        "type": "hostname",
        "uuid": "208a7ce6-be4b-4117-a060-ee8cfe6a040e",
        "value": "outi.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382185",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a851409a-7eae-4f7d-a5ad-0155d5b78899",
        "value": "owa.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382206",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2d885691-1381-400d-98dc-9d404286124d",
        "value": "portal.xeox.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382227",
        "to_ids": true,
        "type": "hostname",
        "uuid": "71414d06-cdb4-4fc4-b198-fcda2c594630",
        "value": "q4b7j.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382248",
        "to_ids": true,
        "type": "hostname",
        "uuid": "951a88b6-469d-4b79-bbaa-771082db964d",
        "value": "roweri.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382269",
        "to_ids": true,
        "type": "hostname",
        "uuid": "027f449f-fc01-4458-bb64-5f4008d86ac3",
        "value": "secure.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382290",
        "to_ids": true,
        "type": "hostname",
        "uuid": "22c6987c-7c47-472c-9743-b7aa35e7275b",
        "value": "share.romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382311",
        "to_ids": true,
        "type": "hostname",
        "uuid": "262abdaa-d7bc-4396-b5cd-e513b54395ca",
        "value": "sign.romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382332",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e3398ede-ba8c-40b8-afab-97f609b7a5dc",
        "value": "t5z1r.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382353",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e633a894-0f9b-45e5-b7fd-c3c9017b6f61",
        "value": "team.romnor.ca",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382374",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8a7664da-3296-414d-93fb-c3961788ba2a",
        "value": "track.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382396",
        "to_ids": true,
        "type": "hostname",
        "uuid": "742e8f33-5908-4a53-958c-ee7a578e91d0",
        "value": "v3n8p.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382417",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f44ea71c-1b3e-46b8-8458-fb01abf39a75",
        "value": "verify.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382438",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6c8f8b94-e688-4b35-a1dd-a546b46ec23f",
        "value": "vinicious.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382459",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4c939d94-851b-4874-8875-7cf59de01f5a",
        "value": "w4j1q.picis.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382481",
        "to_ids": true,
        "type": "hostname",
        "uuid": "99210dec-4bea-4e2c-83da-b886ba1ff18d",
        "value": "ws01.xeox.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382502",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a2df197a-b0cd-4ad1-a9aa-e2384fec62e4",
        "value": "185.163.204.7",
        "Tag": [
          {
            "colour": "#153b63",
            "local": false,
            "name": "asn:asn=\"56322\"",
            "relationship_type": ""
          },
          {
            "colour": "#c82368",
            "local": false,
            "name": "asn:as-owner=\"SERVERASTRA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#0442e9",
            "local": false,
            "name": "asn:as-country=\"HU\"",
            "relationship_type": ""
          },
          {
            "colour": "#78181f",
            "local": false,
            "name": "misp-galaxy:country=\"hungary\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 50101",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784366323",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "9d774be2-a11f-4b1f-bba4-c182a45689ba",
        "value": "216.180.245.166|50101"
      },
      {
        "category": "Network activity",
        "comment": "On port 7077",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784366323",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "9535a01e-59d5-4586-8ab0-0fde29e1227e",
        "value": "188.227.196.240|7077"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382522",
        "to_ids": true,
        "type": "url",
        "uuid": "9219a257-1871-4a07-982d-0d387f7d0525",
        "value": "pastebin.com/u/codemadooo",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382543",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3523a6d4-b48f-4284-8b41-6cc2c21bbbc7",
        "value": "195.20.115.103",
        "Tag": [
          {
            "colour": "#29c31a",
            "local": false,
            "name": "asn:asn=\"20853\"",
            "relationship_type": ""
          },
          {
            "colour": "#85c8ed",
            "local": false,
            "name": "asn:as-owner=\"ETOP-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#ec0428",
            "local": false,
            "name": "asn:as-country=\"PL\"",
            "relationship_type": ""
          },
          {
            "colour": "#c9412f",
            "local": false,
            "name": "misp-galaxy:country=\"poland\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382564",
        "to_ids": true,
        "type": "url",
        "uuid": "88230f73-6c82-433e-b177-ecb7f2ed85f8",
        "value": "verify.picis.net/verify-human",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784382585",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d4ec6c9-363a-49ee-8529-1d82c1e7c08d",
        "value": "20.118.27.127",
        "Tag": [
          {
            "colour": "#4d7cde",
            "local": false,
            "name": "asn:asn=\"8075\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-01-09T23:17:00+00:00",
        "last_seen": "2026-07-05T17:00:12+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784409309",
        "uuid": "7e5bb9ec-9b07-4009-bc16-0055ed1fadb0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "md5",
            "timestamp": "1784409308",
            "to_ids": true,
            "type": "md5",
            "uuid": "d352762e-323b-4f19-b262-b86341d18503",
            "value": "1a37b674ed29c877890834e9aba616d9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "sha1",
            "timestamp": "1784409309",
            "to_ids": true,
            "type": "sha1",
            "uuid": "850cce29-f64f-490a-8ff7-ae9b75b1b86d",
            "value": "ea5d2096a2ef3dfe4fb870bd1f0270efaea993a6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "sha256",
            "timestamp": "1784409309",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f43dae9e-4fdb-408f-8869-7c0396110445",
            "value": "7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "text",
            "timestamp": "1784368425",
            "to_ids": false,
            "type": "text",
            "uuid": "3b8fb3f3-8c4a-4300-bd97-fadf2ad4f668",
            "value": "Type Descriptio%WINDIR%\\Installer\nVerified: Signed\nSigning date: 12:00 PM 12/16/2025\nSigners: ITarian LLC; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)\nMicrosoft: None\nClamAV: None\nVT Total Detection: 15/74\nFirst Seen In The Wild: 2026-03-17T00:32:44+00:00\nFirst Submission: 2026-01-09T23:17:00+00:00\nLast Submission: 2026-07-05T17:00:12+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784368425",
            "to_ids": false,
            "type": "datetime",
            "uuid": "0ba34a28-56ae-4f5e-a871-467709ea81ed",
            "value": "2025-12-16T11:50:34+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368425",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "eeb623bf-ba06-495a-bc1b-2def6f0703cb",
            "value": "1572864:7UorGQf6/f/wEtBJhsVViVS1SVbF2QdapcL5MNK2Ji2oNWX8mR2F71H0:JrGHwmCDqbVbIQdb5MHoNWFR2F71U"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368425",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "07e7531a-66f6-4fdf-a8d3-fbbce2ef6176",
            "value": "114102272"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "vhash",
            "timestamp": "1784368425",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cdb5b1a7-59d7-43a0-b6fd-09020bf2f5b7",
            "value": "5dbc17ed37a6e98f93a9fc8966d583bd"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-01-09T23:17:00+00:00",
            "last_seen": "2026-07-05T17:00:12+00:00",
            "object_relation": "filename",
            "timestamp": "1784368425",
            "to_ids": true,
            "type": "filename",
            "uuid": "27a10e85-4bf9-4e9f-a821-446626ea8b97",
            "value": "em_yWnpHuWY_installer_Win7-Win11_x86_x64.msi"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-05-14T15:44:11+00:00",
        "last_seen": "2026-05-14T15:44:11+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784409313",
        "uuid": "1ac23b4c-adbe-4a16-a45f-8743140a008c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "md5",
            "timestamp": "1784409312",
            "to_ids": true,
            "type": "md5",
            "uuid": "cfc57e37-cd39-4138-899b-7843b653b4e4",
            "value": "fb9c2c07e29a360f4a72b2179db07dda",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "sha1",
            "timestamp": "1784409313",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7034e777-ab87-47d7-bcde-59cea169d75c",
            "value": "e9a44b3fe951cca57313533d6bc1d11e789c2018",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "sha256",
            "timestamp": "1784409313",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ea80fdb9-f1ab-4680-9155-8248995848ec",
            "value": "eab88bba3985f1f8771513bfd8bde4154c4650717bb328e68b02db36b3572415",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "text",
            "timestamp": "1784368530",
            "to_ids": false,
            "type": "text",
            "uuid": "ba998d8c-6ed6-4d4d-92ca-db30f2947ce7",
            "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 19/74\nFirst Submission: 2026-05-14T15:44:11+00:00\nLast Submission: 2026-05-14T15:44:11+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368530",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1a497e13-665d-4fbc-bc5c-13e68e5b35e2",
            "value": "24:9UnW7S55ZI0gB0VmViGZz6hjzdr0G3BitSz:9UnllI/B0VdWzejJTISz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368530",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6add9569-7b88-425d-a291-7a183e859d92",
            "value": "1015"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "vhash",
            "timestamp": "1784368530",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b2cf1499-351f-4d69-acf3-7c78467f524a",
            "value": "85850785e21ced13deccebbee3249ece"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-14T15:44:11+00:00",
            "last_seen": "2026-05-14T15:44:11+00:00",
            "object_relation": "filename",
            "timestamp": "1784368530",
            "to_ids": true,
            "type": "filename",
            "uuid": "d150c896-aec9-45e2-a50f-58c6aaaf5c9c",
            "value": "w98f8fzp.exe"
          }
        ]
      }
    ]
  }
}