{
  "Event": {
    "analysis": "1",
    "date": "2026-07-16",
    "extends_uuid": "",
    "info": "[Threat Intel] HelloNet campaign: a threat via the ViPNet update system",
    "protected": false,
    "publish_timestamp": "1784588109",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784588108",
    "uuid": "60916dab-ca72-4775-89d4-a0f6f75b8817",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Kaspersky\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c57c8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Service Discovery - T1007\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#657ac3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#dac154",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3970d7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#15cd0b",
        "local": false,
        "name": "misp-galaxy:target-information=\"Russia\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#fae37b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c8f8ef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"PuTTY\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:rmm-tool=\"mRemoteNG\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257216",
        "to_ids": false,
        "type": "link",
        "uuid": "75129c5c-78b2-4440-b074-757a7fd5efc9",
        "value": "https://securelist.com/tr/hellonet-vipnet/120700/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257216",
        "to_ids": false,
        "type": "text",
        "uuid": "b3c420e8-e597-40fc-8972-f19bb2eda4bd",
        "value": "An active APT campaign discovered in May 2026 exploits the ViPNet update system to deploy previously unknown tooling against large Russian organizations. Attackers achieve persistence through DLL sideloading, placing malicious wtsapi32.dll in ViPNet directories. The campaign employs multiple components: HelloInjector loader, HelloProxy for traffic proxying and payload delivery, HelloExecutor backdoor for command execution, HelloCleaner for log file sanitization, and HelloBackdoor written in Rust for file manipulation. Attackers conduct reconnaissance activities, establish SSH tunnels using renamed PuTTY utilities, and target government, energy, transport, education, logistics, and industrial sectors. Attribution points to an unknown Chinese-speaking APT group with low confidence based on strings referencing sina.com and Chinese package repositories."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257216",
        "to_ids": false,
        "type": "text",
        "uuid": "27469c99-edc9-4924-9aa9-29562a30dbe1",
        "value": "Name: HelloNet campaign: a threat via the ViPNet update system\nAuthor: AlienVault\nAdversary: \nTags: [\"russia targeted\", \"hellobackdoor\", \"hellocleaner\", \"dll sideloading\", \"chinese apt\", \"helloexecutor\", \"helloproxy\", \"rust backdoor\", \"hellonet\", \"helloinjector\", \"vipnet\", \"ssh tunneling\", \"putty\"]\nTgtd countries: [\"Russian Federation\"]\nMlwr families: [\"HelloInjector\", \"HelloProxy\", \"HelloExecutor\", \"HelloCleaner\", \"HelloBackdoor\"]\nAttack_ids: [\"T1074.001\", \"T1543.003\", \"T1007\", \"T1082\", \"T1071\", \"T1005\", \"T1036\", \"T1055\", \"T1572\", \"T1112\", \"T1016\", \"T1090\", \"T1083\", \"T1049\", \"T1057\", \"T1562.001\", \"T1573\", \"T1059.003\", \"T1070.004\", \"T1018\", \"T1574.002\", \"T1105\"]\nIndustries: [\"Government\", \"Energy\", \"Transportation\", \"Education\", \"Aerospace\"]"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585019",
        "to_ids": true,
        "type": "md5",
        "uuid": "65df3644-dea2-43f3-9a38-37430d408fd5",
        "value": "0cfdffc56f0fa325d0c4d24780b46597",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585020",
        "to_ids": true,
        "type": "md5",
        "uuid": "be971f07-cffc-413f-8057-7d388f2e6fe3",
        "value": "16c211c96735f2fae9361b89bd7a31bf",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585021",
        "to_ids": true,
        "type": "md5",
        "uuid": "8cf17051-736b-4228-ae39-5a0148ceb982",
        "value": "41c938b3cd7e55d4077e34976929b140",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585021",
        "to_ids": true,
        "type": "md5",
        "uuid": "a4cb6782-cb3e-4d86-9492-e10e305494a8",
        "value": "6001829a128fe264b4403138700c11a8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585023",
        "to_ids": true,
        "type": "md5",
        "uuid": "2d7d0601-ae17-4f17-a65a-1e16332c6ac4",
        "value": "9f5606a0755bc633b9bd7db6d179c09e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585023",
        "to_ids": true,
        "type": "md5",
        "uuid": "a71e8255-2043-4044-b5b6-bc0de228dd07",
        "value": "ee4ff46ddd8489e81447962f927bc3f6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585024",
        "to_ids": true,
        "type": "md5",
        "uuid": "0227b23c-0a31-4616-a176-fd18f18c945c",
        "value": "f9eed2f0158dc98e7012fb809152209c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585423",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0d40398f-6a45-49a5-8f83-f9cd20d6793c",
        "value": "176.32.34.135",
        "Tag": [
          {
            "colour": "#977262",
            "local": false,
            "name": "asn:asn=\"51659\"",
            "relationship_type": ""
          },
          {
            "colour": "#20fc91",
            "local": false,
            "name": "asn:as-owner=\"ASBAXET\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585444",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "af86ff40-f2c2-4022-80ec-4bc3df64917c",
        "value": "5.39.253.206",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-13T11:15:12+00:00",
        "last_seen": "2026-07-13T11:15:12+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784585465",
        "uuid": "2f068313-3969-4aae-8982-aef28d95e734",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "md5",
            "timestamp": "1784585465",
            "to_ids": true,
            "type": "md5",
            "uuid": "35798e73-397d-4fdf-89b8-43059318f035",
            "value": "1bfe2b9493128574907a8279256a8bcc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585017",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3e106215-910d-41f0-9437-0b3868a76507",
            "value": "c1f6ca815b6395ee1ec8d749065c7e9018a9fc9a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585017",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8f3435ef-b2f6-4434-8b1a-8512109da51e",
            "value": "68b4c76a2280e3c31130d4de12b12dfd479a476f347f5b4a58cb2483d74aba7e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "text",
            "timestamp": "1784582711",
            "to_ids": false,
            "type": "text",
            "uuid": "ddb1ba3e-9cbc-4e4c-ab40-8fa6a04bfa1d",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 37/74\nFirst Submission: 2026-07-13T11:15:12+00:00\nLast Submission: 2026-07-13T11:15:12+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784582711",
            "to_ids": false,
            "type": "datetime",
            "uuid": "4d0ef07f-5aef-4fbb-b068-fc908a9ec82f",
            "value": "2026-05-14T08:22:35+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784582711",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ab8a62bd-ba9c-4c5c-9ec2-4025375ab4a1",
            "value": "24576:mMfoptgQ/ehClfNr8Wk3aRVdHbPwYZ7bqFV7MdTQ1rtypRQ9s4cWx:Zf5QM9q5HbIYZabQTIrtyXincS"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784582711",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c29c8d49-1488-44c8-b861-42c453a7e427",
            "value": "1131008"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "vhash",
            "timestamp": "1784582711",
            "to_ids": true,
            "type": "vhash",
            "uuid": "928af5b5-7d2a-4f8d-8af9-9dda4d634028",
            "value": "01603e0f7d1019z43z1pz17z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T11:15:12+00:00",
            "last_seen": "2026-07-13T11:15:12+00:00",
            "object_relation": "filename",
            "timestamp": "1784582711",
            "to_ids": true,
            "type": "filename",
            "uuid": "821ee9a3-6b85-44fe-99cc-2f7bc437e44b",
            "value": "wqydi3.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-13T14:50:19+00:00",
        "last_seen": "2026-07-14T08:21:45+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784585486",
        "uuid": "c809c2db-0f81-4265-ba9f-149f78cb8bf1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "md5",
            "timestamp": "1784585486",
            "to_ids": true,
            "type": "md5",
            "uuid": "a4794765-02ae-473f-b992-b494cc54f4b9",
            "value": "b103cd21280b4061f88b2bcc51394894",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585018",
            "to_ids": true,
            "type": "sha1",
            "uuid": "04cec8d8-0ed0-4ee0-b4ee-8c58dd81c26f",
            "value": "686292c07e33c4a5ca456db446bb71fb9fc67a81",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585018",
            "to_ids": true,
            "type": "sha256",
            "uuid": "042b8687-adee-4a65-a5bd-120d16951dc1",
            "value": "ffdc194775b2904564bbbd1cf0eb01d1a01f83ef5197d1612b6e2d69de7a4732",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "text",
            "timestamp": "1784582795",
            "to_ids": false,
            "type": "text",
            "uuid": "eba55951-5fb6-42c2-9048-0d2f1d516e7f",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2026-07-13T14:50:19+00:00\nLast Submission: 2026-07-14T08:21:45+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784582795",
            "to_ids": false,
            "type": "datetime",
            "uuid": "ec0c2678-c6b0-4b48-b7b4-65bcf89d2a22",
            "value": "2026-06-21T05:07:17+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784582795",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bdc783f8-6f73-4ceb-b552-8763b7b66ee2",
            "value": "3072:sy8rtdwbtjpXcNJ1EF0WSFEyIfhncedz3sWsWTBfriDvXNBM:sywTete7117Yhc6AWTBTa"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784582795",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e771732a-90ff-45e0-b427-9ff6e485cbba",
            "value": "222720"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "vhash",
            "timestamp": "1784582795",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d020d6e5-5ab3-4fe2-a7e9-4a0733b6a882",
            "value": "125066651d6515051\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T14:50:19+00:00",
            "last_seen": "2026-07-14T08:21:45+00:00",
            "object_relation": "filename",
            "timestamp": "1784582795",
            "to_ids": true,
            "type": "filename",
            "uuid": "2b9b21ed-87f9-4886-9795-573b14113d6c",
            "value": "wtsapi32.dll"
          }
        ]
      }
    ]
  }
}