{
  "Event": {
    "analysis": "1",
    "date": "2026-07-20",
    "extends_uuid": "",
    "info": "[Threat Intel] Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant",
    "protected": false,
    "publish_timestamp": "1785033931",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785033931",
    "uuid": "5cf03560-1e1a-433b-ade1-150d81415b71",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#682cad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Portal Capture - T1056.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0fe1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#dac154",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#1acf09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#b596f0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Lateral Tool Transfer - T1570\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Kimsuky\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"South Korea\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"north korea\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Gomir\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Linux\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Windows\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"UNIX\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631633",
        "to_ids": false,
        "type": "link",
        "uuid": "794e995d-3706-4708-9d21-7ce07b28185d",
        "value": "https://www.enki.co.kr/en/media-center/blog/analysis-of-kimsuky-s-attack-on-a-south-korean-groupware-vendor-using-a-new-gomir-family-variant",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631633",
        "to_ids": false,
        "type": "text",
        "uuid": "ff03e4b7-75ce-4d10-ac52-20868c529230",
        "value": "Between 2025 and early 2026, the North Korean-linked Kimsuky group infiltrated South Korean groupware vendors through vulnerability exploitation and spear-phishing. They deployed two new malware variants, BirdTroy and DriveTroy, based on the Gomir/HttpTroy family. BirdTroy uses custom protocols and HTTP/3 (QUIC) for command-and-control communication, while DriveTroy abuses Google Drive as a C2 channel to evade detection. Following initial compromise, Kimsuky conducted aggressive lateral movement, compromising customer groupware servers and tampering with vendor login pages to harvest credentials. The attackers leveraged legitimate tools like DWAgent for remote access and custom proxy tools for lateral movement. Attribution is supported by malware characteristics, infrastructure patterns including default XAMPP certificates, and historical ASN usage consistent with previous Kimsuky operations."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631633",
        "to_ids": false,
        "type": "text",
        "uuid": "a3afcf65-6a2a-4a34-b150-060c6475b1ca",
        "value": "Name: Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant\nAuthor: AlienVault\nAdversary: Kimsuky\nTags: [\"groupware\", \"trollstealer\", \"google drive c2\", \"gomir\", \"supply-chain\", \"gobear\", \"drivetroy\", \"httpspy\", \"south korea\", \"birdtroy\", \"endoor\", \"kimsuky\", \"httptroy\"]\nTgtd countries: []\nMlwr families: [\"Gomir\", \"HttpTroy\", \"BirdTroy\", \"DriveTroy\", \"TrollStealer\", \"GoBear\", \"Endoor\", \"HttpSpy\"]\nAttack_ids: [\"T1113\", \"T1132.001\", \"T1204.002\", \"T1573.001\", \"T1053.003\", \"T1082\", \"T1005\", \"T1140\", \"T1190\", \"T1021\", \"T1056.003\", \"T1016\", \"T1090\", \"T1083\", \"T1036.004\", \"T1049\", \"T1041\", \"T1199\", \"T1566\", \"T1059.004\", \"T1078\", \"T1102.002\", \"T1567.002\", \"T1570\", \"T1070.004\", \"T1027.002\", \"T1071.001\", \"T1543.002\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631633",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "45141dbd-8a2f-41b7-b956-71858185e095",
        "value": "Kimsuky"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902430",
        "to_ids": true,
        "type": "hostname",
        "uuid": "20ac8e50-cc10-43c8-8358-0d7a525f3957",
        "value": "commit.hanbiro.o-r.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902452",
        "to_ids": true,
        "type": "url",
        "uuid": "993d3426-71bc-44ab-b9cf-a280b81d02c7",
        "value": "https://www.dwservice.net/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902474",
        "to_ids": true,
        "type": "hostname",
        "uuid": "73a7f0e4-d875-4b3f-ac26-0b9b9d2d2676",
        "value": "node828765.dwservice.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902497",
        "to_ids": true,
        "type": "hostname",
        "uuid": "829d78e8-adf2-4228-acbb-53d109997f5b",
        "value": "node896147.dwservice.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Gomir No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899541",
        "to_ids": true,
        "type": "md5",
        "uuid": "0cd64537-7512-44db-9359-3efcaec1ab49",
        "value": "84e9b066bebd49036b7fc71b5f5f8d83",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "DriveTroy No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899542",
        "to_ids": true,
        "type": "md5",
        "uuid": "7341e10b-cfa2-4e0e-8816-7903d8e91ea2",
        "value": "a452a860f973c7a43ea804c17e9427d2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Gomir No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899543",
        "to_ids": true,
        "type": "md5",
        "uuid": "f73a245c-e2a0-4ffe-b631-461739f961ae",
        "value": "aa61e76255a6e13313439655bc02bdf5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BirdTroy No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899544",
        "to_ids": true,
        "type": "md5",
        "uuid": "a3d54468-e4a4-4463-b6ba-4fed5afd03ab",
        "value": "c2e37232556357944a04edf1dec3934b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BirdTroy No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899546",
        "to_ids": true,
        "type": "md5",
        "uuid": "a0323a8b-8f1d-4f0d-96f1-249f1eab0229",
        "value": "ca98a51cebdc802d255030b4baa44ca0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "DWAgent.zip No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899547",
        "to_ids": true,
        "type": "md5",
        "uuid": "078b37f8-15c6-4788-b1d6-54ed9d226c3a",
        "value": "dff787bce68c7653495f153c0534cb96",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Gomir No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899548",
        "to_ids": true,
        "type": "md5",
        "uuid": "67dae129-3560-4f49-a87c-6fcc81711bfc",
        "value": "e911f8f7c49476806ada37f3ebb7a28a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030400",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "340cdc6d-8a13-4a2b-a59a-499c39ea307e",
        "value": "163.245.195.172",
        "Tag": [
          {
            "colour": "#c5b4f1",
            "local": false,
            "name": "asn:asn=\"17\"",
            "relationship_type": ""
          },
          {
            "colour": "#b73c73",
            "local": false,
            "name": "asn:as-owner=\"PURDUE\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030422",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b58a3acc-fdc5-4046-8fc9-878a9b5f2b41",
        "value": "69.10.50.165",
        "Tag": [
          {
            "colour": "#0ec520",
            "local": false,
            "name": "asn:asn=\"26666\"",
            "relationship_type": ""
          },
          {
            "colour": "#b6feca",
            "local": false,
            "name": "asn:as-owner=\"INTERSERVER-LAX\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030443",
        "to_ids": true,
        "type": "url",
        "uuid": "aae1dceb-80c7-459a-b32f-6677f5525fba",
        "value": "http://auth.samecloud.o-r.kr/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030465",
        "to_ids": true,
        "type": "url",
        "uuid": "03a24f21-5c01-402a-b15f-f3990a286f81",
        "value": "http://www.ilskdeid.o-r.kr:8000/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030486",
        "to_ids": true,
        "type": "url",
        "uuid": "41eee530-92c0-4713-a714-249013e324d8",
        "value": "https://auth.samecloud.o-r.kr/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030507",
        "to_ids": true,
        "type": "url",
        "uuid": "1ffd0e5d-a841-4dd0-beda-9f712bc62f00",
        "value": "https://commit.hanbiro.o-r.kr/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030529",
        "to_ids": true,
        "type": "url",
        "uuid": "a9b18e25-f17e-4424-ab62-a4e063d388e1",
        "value": "https://global.webjine.o-r.kr/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030550",
        "to_ids": true,
        "type": "url",
        "uuid": "745599b6-49cf-44ea-b78a-caa603e34fa0",
        "value": "https://oauth.shacloud.o-r.kr:8443",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030571",
        "to_ids": true,
        "type": "url",
        "uuid": "3267e0b4-f4e9-476c-9c52-fc6256dcc15b",
        "value": "https://oobe.webjine.o-r.kr/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030593",
        "to_ids": true,
        "type": "hostname",
        "uuid": "aa6c2fee-5301-4d1d-8eb0-6e92d534ed72",
        "value": "auth.samecloud.o-r.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030614",
        "to_ids": true,
        "type": "hostname",
        "uuid": "268cc3de-3c02-4141-a0b5-7a94543e2bec",
        "value": "global.webjine.o-r.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030635",
        "to_ids": true,
        "type": "hostname",
        "uuid": "43847413-8a73-4b5b-b9d1-b1bb9a93e066",
        "value": "node449013.dwservice.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030657",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e7331ded-6561-4fd5-80fd-1ff55a46b7ab",
        "value": "oauth.shacloud.o-r.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030678",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3139ebfd-426f-4764-95fb-bc737fd269d0",
        "value": "oobe.webjine.o-r.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030699",
        "to_ids": true,
        "type": "hostname",
        "uuid": "22fde1ca-9783-41ad-87b2-8ecde8e19d5b",
        "value": "www.ilskdeid.o-r.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "HttpTroy variant No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899549",
        "to_ids": true,
        "type": "md5",
        "uuid": "fea3a618-b993-4d8e-a530-f5cc5674c1a3",
        "value": "633c3076c396f2200048d1b62da204d2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030721",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d8e9fdcf-6e65-40f4-b846-e1097a0fb264",
        "value": "208.73.202.29",
        "Tag": [
          {
            "colour": "#ed7843",
            "local": false,
            "name": "asn:asn=\"19318\"",
            "relationship_type": ""
          },
          {
            "colour": "#a698d7",
            "local": false,
            "name": "asn:as-owner=\"IS-AS-1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C&C server URL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030742",
        "to_ids": true,
        "type": "url",
        "uuid": "c65601d4-8cde-4196-a42d-2377e7deaad8",
        "value": "https://69.10.50.165:8443)",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C&C server URL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030763",
        "to_ids": true,
        "type": "url",
        "uuid": "15bb146b-e05c-4a37-bbdc-4396d38d8c48",
        "value": "https://69.10.50.165:8443",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2025-12-17T01:44:54+00:00",
        "last_seen": "2025-12-17T01:44:54+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785030784",
        "uuid": "94764f01-6d86-4126-9623-e4b9e0901b4b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Gomir",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "md5",
            "timestamp": "1785030784",
            "to_ids": true,
            "type": "md5",
            "uuid": "93007438-48a1-4bbe-a188-6c6593c95c2c",
            "value": "b1c72139f2cdd9419562369fc6ced4fc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Gomir",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899537",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ab4eacd2-7c95-4551-b970-8b434b221f2c",
            "value": "f3ed0bcc692555fea83c6556abaa5dc2b91bcb38",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Gomir",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899537",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6c551c76-aa08-4b0c-a649-20f83cf8af5b",
            "value": "073d9dd98a9ca3cd03901c31ba57811a1632e316923022640670ce00622cd8a9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 22/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "text",
            "timestamp": "1784898949",
            "to_ids": false,
            "type": "text",
            "uuid": "7b555d36-b4b7-4098-b848-1efa0cc5d16a",
            "value": "Gomir\r\nType Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 26/74\nFirst Seen In The Wild: 2026-07-23T13:34:58+00:00\nFirst Submission: 2025-12-17T01:44:54+00:00\nLast Submission: 2025-12-17T01:44:54+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898949",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "745b81f5-4462-47fa-88c2-ff54e3e57632",
            "value": "49152:yzLP37Bx0unc2OvhMC5b0h6pU4qSufbbNVuHHAzYEu0htHrh3axbQz5mggZWJPKn:ynSonSuTunAs01rF+bO5GyyfMtETDd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898949",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "94b4ad2a-d551-4f7f-bcf9-1395190e4ced",
            "value": "7000212"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898949",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b5ed9345-4ded-4506-bd7f-9af65e871133",
            "value": "a32d859bd1256dc8d6bca18d4f8c19bc"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-12-17T01:44:54+00:00",
            "last_seen": "2025-12-17T01:44:54+00:00",
            "object_relation": "filename",
            "timestamp": "1784898949",
            "to_ids": true,
            "type": "filename",
            "uuid": "f494cec9-4434-4df0-9d5c-12e7c3f1cd01",
            "value": "4vhpgibr.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2021-07-06T13:27:13+00:00",
        "last_seen": "2022-12-20T15:43:55+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785030806",
        "uuid": "de59e5f7-349e-4a6c-973d-9a3777d0013f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "md5",
            "timestamp": "1785030806",
            "to_ids": true,
            "type": "md5",
            "uuid": "0bfb1108-530e-430d-a135-a71e6871a674",
            "value": "bf215181b5140522137b3d4f6b73544a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899538",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b993584d-0080-4b2a-b7aa-84f02f182e92",
            "value": "64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899538",
            "to_ids": true,
            "type": "sha256",
            "uuid": "052bf0b6-1007-42fe-86d5-e45fa98802f8",
            "value": "c0b0109d9439de57fe3cf03abeccbc52f4c98170c732d3b69af5e6395ace574e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 06/07/2021",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "text",
            "timestamp": "1784898971",
            "to_ids": false,
            "type": "text",
            "uuid": "256130bd-1aa3-4a9c-acac-f941f6497e84",
            "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2021-07-06T13:27:13+00:00\nLast Submission: 2022-12-20T15:43:55+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898971",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "434db7ae-d4e8-4874-96f4-bbd2dd1e5978",
            "value": "3:jS:jS"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898971",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ddad0666-5db8-4b29-bf35-2dea420e5524",
            "value": "6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898971",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e5c032a4-20d5-4492-b99b-71cf3e76804d",
            "value": "9eecb7db59d16c80417c72d1e1f4fbf1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2021-07-06T13:27:13+00:00",
            "last_seen": "2022-12-20T15:43:55+00:00",
            "object_relation": "filename",
            "timestamp": "1784898971",
            "to_ids": true,
            "type": "filename",
            "uuid": "6affca67-c1c8-434e-9d43-adf91dc3c3a8",
            "value": ".gitignore"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2025-12-17T01:44:53+00:00",
        "last_seen": "2025-12-17T04:51:32+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785030827",
        "uuid": "cd841298-c554-4641-9310-283cf126f7e1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Gomir (UPX packed)",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "md5",
            "timestamp": "1785030827",
            "to_ids": true,
            "type": "md5",
            "uuid": "371848ad-64e1-4c24-9944-684c3f17461b",
            "value": "e6c6fa32da47d9341b778bfa424abb4c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Gomir (UPX packed)",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899540",
            "to_ids": true,
            "type": "sha1",
            "uuid": "60362cba-7b6a-4627-9a96-4852d73c0bd0",
            "value": "3fb6111490cac9f5c4b34f9fed459f01c10d2314",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Gomir (UPX packed)",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899540",
            "to_ids": true,
            "type": "sha256",
            "uuid": "13ea2099-dcc8-4008-99de-2a24cbd3b37c",
            "value": "01b1c767f62e48efeb86410fd014fed4295ccb084bfcd6d5b9197638b615a648",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "text",
            "timestamp": "1784899056",
            "to_ids": false,
            "type": "text",
            "uuid": "7aeb2ed0-3b24-412e-b210-3a92da7c137b",
            "value": "Gomir (UPX packed)\r\nType Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 30/74\nFirst Seen In The Wild: 2026-07-23T13:34:53+00:00\nFirst Submission: 2025-12-17T01:44:53+00:00\nLast Submission: 2025-12-17T04:51:32+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784899056",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a1a3102e-5042-49da-84e1-bda32586c1fe",
            "value": "49152:IvDjnf2Vpf70BQgI02YzGJY/uJhvLItcznka2POed935ktKrddM:u+n43dSaGJRstc4agBB5OK5dM"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784899056",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "11c67cf0-0587-4cdb-90ec-750c120d364e",
            "value": "2705868"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "vhash",
            "timestamp": "1784899056",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ea04016e-9d3c-48ab-8241-f1f25e575b99",
            "value": "2a85fbef90580a5a9f23c0c917daa086"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2025-12-17T01:44:53+00:00",
            "last_seen": "2025-12-17T04:51:32+00:00",
            "object_relation": "filename",
            "timestamp": "1784899056",
            "to_ids": true,
            "type": "filename",
            "uuid": "3c687c5b-f96f-42aa-aae2-82df63f5f3ed",
            "value": "_rsyslogd"
          }
        ]
      }
    ]
  }
}