{
  "Event": {
    "analysis": "1",
    "date": "2026-05-30",
    "extends_uuid": "",
    "info": "[Threat Intel] A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites",
    "protected": false,
    "publish_timestamp": "1780521444",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780521443",
    "uuid": "60f381bf-1ce4-4f1c-bf8f-bbe210033304",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7a1ce1",
        "local": false,
        "name": "misp-galaxy:producer=\"Silent Push\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Digital Certificates - T1588.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#280b0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a5d84",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#0aebeb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#44b2c2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003d",
        "local": false,
        "name": "rectifyq:sub-category=\"TA-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#680082",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"MacOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780311614",
        "to_ids": false,
        "type": "link",
        "uuid": "500b2d13-1713-472b-9b4c-07be3608ecad",
        "value": "https://www.silentpush.com/blog/drivesurge/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780311614",
        "to_ids": false,
        "type": "text",
        "uuid": "f21e047a-12be-4863-93fd-8286ae938509",
        "value": "DriveSurge is a newly identified threat actor operating as an Initial Access Broker using a Pay-Per-Install model to supply victim leads to downstream actors. The actor has compromised thousands of websites, injecting malicious code that redirects visitors through zTDS (Traffic Distribution System) to deliver malware via two primary methods: FakeUpdates, which impersonate browser update prompts for Chrome, Firefox, Edge, Safari, and eight other browsers; and ClickFix, which tricks users into executing malicious PowerShell commands disguised as fixes. DriveSurge leverages sophisticated infrastructure including bulletproof hosting, obfuscated JavaScript injection patterns, and environment-specific targeting including macOS systems. The operation has been active since at least September 2025, utilizing specific technical fingerprints including unique file naming conventions and server configurations that enable detection and tracking of their evolving infrastructure."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780311614",
        "to_ids": false,
        "type": "text",
        "uuid": "e39bf3e4-5d2e-4016-aeab-af42aa2d9b3e",
        "value": "Name: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites\nAuthor: AlienVault\nAdversary: DriveSurge\nTags: [\"initial access broker\", \"ztds\", \"clickfix\", \"drive-by attacks\", \"fakeupdates\", \"drivesurge\", \"macos targeting\", \"bulletproof hosting\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1588.004\", \"T1204.002\", \"T1566.002\", \"T1140\", \"T1583.001\", \"T1055\", \"T1112\", \"T1090.002\", \"T1583.006\", \"T1059.001\", \"T1547.001\", \"T1059.004\", \"T1027\", \"T1203\", \"T1059.006\", \"T1070.004\", \"T1189\", \"T1564.001\", \"T1204.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780312946",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "88d7a6fd-df4d-4a1b-959a-6f0982ab53e9",
        "value": "DriveSurge",
        "Tag": [
          {
            "colour": "#7a1ce1",
            "local": false,
            "name": "misp-galaxy:producer=\"Silent Push\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498193",
        "to_ids": true,
        "type": "domain",
        "uuid": "2c0c50a9-307c-49c7-9247-d4fe5e75d41c",
        "value": "ztds.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498215",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "303c6607-8429-4ea0-99d6-ccf727eaa8a1",
        "value": "91.92.240.127",
        "Tag": [
          {
            "colour": "#ce048f",
            "local": false,
            "name": "asn:asn=\"209800\"",
            "relationship_type": ""
          },
          {
            "colour": "#434f78",
            "local": false,
            "name": "asn:as-owner=\"METASPINNER-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498236",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "84a9c806-41d9-432f-b1d8-f10618542b97",
        "value": "46.226.166.57",
        "Tag": [
          {
            "colour": "#c3e702",
            "local": false,
            "name": "asn:asn=\"210644\"",
            "relationship_type": ""
          },
          {
            "colour": "#c047ce",
            "local": false,
            "name": "asn:as-owner=\"AEZA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498258",
        "to_ids": true,
        "type": "domain",
        "uuid": "39530c35-f001-4762-a695-81844426431b",
        "value": "cptoptious.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498279",
        "to_ids": true,
        "type": "domain",
        "uuid": "1ff3d6e7-5d73-42f1-ba2d-33ce218bf63e",
        "value": "captioto.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498300",
        "to_ids": true,
        "type": "domain",
        "uuid": "7540d55c-9999-45d5-8b1d-95fdb6408a2b",
        "value": "newtdsone.shop",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498321",
        "to_ids": true,
        "type": "domain",
        "uuid": "2db95328-57c5-4e5c-b62d-331c509dc15a",
        "value": "maxintora.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498343",
        "to_ids": true,
        "type": "hostname",
        "uuid": "51e3d992-7e14-4d85-ac55-4da37aa235f6",
        "value": "check.first-node.rocks",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498364",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a235de3b-e51c-4316-94bc-037c6ff83c3a",
        "value": "testio.ecartdev.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498385",
        "to_ids": true,
        "type": "domain",
        "uuid": "637a25c8-7814-499d-8941-cdcb676cd4fa",
        "value": "webgleam.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498406",
        "to_ids": true,
        "type": "domain",
        "uuid": "2159b98c-d2dd-414c-99b5-20f0a95fec9d",
        "value": "brightson.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498428",
        "to_ids": true,
        "type": "domain",
        "uuid": "6d8c95e5-6994-4f04-95b5-f6dd4932a787",
        "value": "datumprobe.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498450",
        "to_ids": true,
        "type": "domain",
        "uuid": "624c558f-f4fb-468a-aecf-ffb99e42eaf9",
        "value": "keyview.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498471",
        "to_ids": true,
        "type": "domain",
        "uuid": "094d05a1-264e-4b06-a2d2-25cba26dbf51",
        "value": "traceglimpse.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498492",
        "to_ids": true,
        "type": "domain",
        "uuid": "e8d9169f-d41a-4b7f-8cc0-1d4acf955deb",
        "value": "coverlink.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498513",
        "to_ids": true,
        "type": "domain",
        "uuid": "149068d3-754e-4251-a4cd-8669ff692f49",
        "value": "tracekey.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498001",
        "to_ids": true,
        "type": "md5",
        "uuid": "c0258b84-466e-41b8-b2d8-d1d7b5e7a636",
        "value": "0ca424475803a1cb54908a81a00bd93f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498002",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1680b38e-0e17-4ba4-a6a7-7c8e19326273",
        "value": "29ac78c51bcdfe68c64830bdeb6e41437dd55e2691149741c9b78be03b6c82ea",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498003",
        "to_ids": true,
        "type": "sha256",
        "uuid": "8eb94615-1a0a-4c0c-932a-40f0f7c0c4a0",
        "value": "428bd0b0ac36dfdd223b3953dbe61c0baf227f893310b03e7afe3111462019c6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498004",
        "to_ids": true,
        "type": "sha256",
        "uuid": "6250f2de-ee44-4bc2-84e1-bb63392e9d8b",
        "value": "a84b032b49773c2318b11b1164d1aada69e940229aedbf8185c33fc7dd1d2cdf",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498534",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e3a608f7-a277-43f3-964f-a4bce2b5dbfd",
        "value": "147.45.42.200",
        "Tag": [
          {
            "colour": "#c3e702",
            "local": false,
            "name": "asn:asn=\"210644\"",
            "relationship_type": ""
          },
          {
            "colour": "#c047ce",
            "local": false,
            "name": "asn:as-owner=\"AEZA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498556",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "214ca1eb-4206-44f0-96e2-1559106b7a0d",
        "value": "147.45.42.205",
        "Tag": [
          {
            "colour": "#c3e702",
            "local": false,
            "name": "asn:asn=\"210644\"",
            "relationship_type": ""
          },
          {
            "colour": "#c047ce",
            "local": false,
            "name": "asn:as-owner=\"AEZA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498577",
        "to_ids": true,
        "type": "url",
        "uuid": "0db0aa3b-1031-48d1-8239-bd92e6528899",
        "value": "http://bseolized.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498598",
        "to_ids": true,
        "type": "url",
        "uuid": "cad9493a-1b13-4378-95df-650a4bcc02e2",
        "value": "http://newtdsone.shop/jsrepo?rnd=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498620",
        "to_ids": true,
        "type": "domain",
        "uuid": "03c1563f-57bd-4c94-bfa6-7218865a009c",
        "value": "beacontrace.bond",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498641",
        "to_ids": true,
        "type": "domain",
        "uuid": "f69a9c4b-ae5f-40c1-98ce-cbdead6d1147",
        "value": "bseolized.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498662",
        "to_ids": true,
        "type": "domain",
        "uuid": "9f0ecd63-d453-458d-9af9-8dffebb8d17d",
        "value": "eraggifts.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498683",
        "to_ids": true,
        "type": "domain",
        "uuid": "3fd62090-1b93-45c5-b0e3-c30ce5a10cc5",
        "value": "jcdlforwarding.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498705",
        "to_ids": true,
        "type": "domain",
        "uuid": "b90980e2-da0b-42fb-9b2b-7b837ff2386d",
        "value": "jclforwarding.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498726",
        "to_ids": true,
        "type": "domain",
        "uuid": "316ecd95-10ca-4981-9a52-5d23d581b69a",
        "value": "ycyfugihih.cfd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498747",
        "to_ids": true,
        "type": "url",
        "uuid": "93d72d68-273f-4e15-a460-99e152dc7b93",
        "value": "http://147.45.42.200/ce3cbfc887?force=1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498768",
        "to_ids": true,
        "type": "url",
        "uuid": "b252fd20-c279-47ee-b7c9-3ad039185189",
        "value": "http://46.226.166.57/ce3cbfc887?force=1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498789",
        "to_ids": true,
        "type": "url",
        "uuid": "c112fcbc-09f1-4eb8-9d37-f02d20408daf",
        "value": "http://147.45.42.200/66856ca57ed?force=1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498810",
        "to_ids": true,
        "type": "url",
        "uuid": "43bf9c8a-140d-43c2-bcbe-f5397b24a782",
        "value": "http://46.226.166.57/66856ca57ed?force=1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498831",
        "to_ids": true,
        "type": "url",
        "uuid": "4a01215c-e2e2-40fd-b1cd-73e39d368003",
        "value": "http://147.45.42.200/e97b7f7ccab3a?force=1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498853",
        "to_ids": true,
        "type": "url",
        "uuid": "434ed702-6870-46f7-a7c7-c78c1f288ad7",
        "value": "http://46.226.166.57/e97b7f7ccab3a?force=1",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 8133",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780313072",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "b2d7bcd9-3be7-4164-9860-9e0709888597",
        "value": "147.45.42.205|8133"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780498874",
        "uuid": "ea043ce3-9c50-4dfb-ac84-7edf9a8ad0d9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780498874",
            "to_ids": true,
            "type": "md5",
            "uuid": "cf2ab8b9-ecff-4ffc-af30-c80f0cc3ef2f",
            "value": "f3926add1a4531ff324a6acb57d40769",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780497995",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6c42a1c2-4f8b-4ee9-ac99-0a1ac405887f",
            "value": "a4f0014474278238b5fe78fc2c4182b498012a33",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780497995",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5ec1192d-fc89-4851-8957-ee9265b2d079",
            "value": "7aa15de93cf85729ddf970e8d7897f69ece3ca29608f73e784a9ba40c9cea18d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780496320",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4cc782f4-8c66-456d-8103-83602de245b7",
            "value": "48:Kdq0iKzY05BK1o4rshlvsGYUmgGoWpa4jQs+NaFUaGFarqk:kq05zY0q1o4uRXbmgGrJQsRCkqk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780496320",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "acb4eacb-cbd3-4631-bd0f-42ed25b6729f",
            "value": "3066"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780496320",
            "to_ids": true,
            "type": "filename",
            "uuid": "9fabe26b-f1fe-4a25-9040-3a28faea5c04",
            "value": "ce3cbfc887"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780496320",
            "to_ids": false,
            "type": "text",
            "uuid": "3a682f0c-d28e-48c5-b8d9-e0611e6ab574",
            "value": "Type Description: Shell script\nMicrosoft: Trojan:Win32/Vigorf.A\nVT Total Detection:28/61\nFirst Submission:2026-04-10T13:07:22.000000+00:00\nLast Submission:2026-04-13T08:18:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780498896",
        "uuid": "d31e8d77-7659-4f7a-abf6-0d97e43a482c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780498896",
            "to_ids": true,
            "type": "md5",
            "uuid": "533abed8-23ed-4b0a-a1f7-cf10bf3563aa",
            "value": "f193e0d87917cb8866ef6464c5096c6a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780497997",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bb975a56-b0ed-4767-a3a7-aafc26846940",
            "value": "4079660c5cb79f6ca8c132a347a3c80022abe2cb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780497997",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2d937d15-23b6-478f-8b8c-a6743f460034",
            "value": "0c62c11e910d7c0d6b6c9800b70e78bfd9220e1f78bd7bb34ae4c3646d05f6e5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780496342",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0e46072a-e4a0-4860-9e98-26cdba02693a",
            "value": "3:bFq:Q"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780496342",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a9feb185-7e66-4495-b24c-bc89badb13e8",
            "value": "13"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780496342",
            "to_ids": true,
            "type": "filename",
            "uuid": "4f4dad07-0465-4a68-983a-8a73bec79e29",
            "value": "EMPTY.HTM"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  02/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780496342",
            "to_ids": false,
            "type": "text",
            "uuid": "1fcc6269-26fd-4c4b-a9b9-3382bd03d16f",
            "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2011-12-24T22:16:27.000000+00:00\nLast Submission:2026-05-19T10:16:40.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780498917",
        "uuid": "12288e73-0732-49cd-9b71-fede6281ea30",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780498917",
            "to_ids": true,
            "type": "md5",
            "uuid": "0f829cf2-de41-4949-9687-7705c28b221e",
            "value": "ebd8b20112b3865f8b51ace4b1b0983e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780497998",
            "to_ids": true,
            "type": "sha1",
            "uuid": "677c1d86-e0a7-45ad-a077-ce37f80a9d59",
            "value": "bf6743b077faf7e63ae0b397301047210db3646c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780497998",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2ce68e91-6256-460c-85ca-c5eebd32c34f",
            "value": "90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780496406",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "60182fb9-7826-4211-a10f-a868c4faf978",
            "value": "98304:/5qw1kIRHjdEegxN7frL5Tz60s+wn3w74FN:bk8jiffrprkw74z"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780496406",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4ea3af47-5c35-4b74-a6c2-22459d4950ca",
            "value": "4020599"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780496406",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0bd82def-547b-4bb2-80f2-948a405bea7d",
            "value": "7ecff2665bd91e2b47ca75197039984f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780496406",
            "to_ids": true,
            "type": "filename",
            "uuid": "3628d2f3-d999-4b19-b4b8-35fe99f79584",
            "value": "Chrome Updater.zip"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780496406",
            "to_ids": false,
            "type": "text",
            "uuid": "9dce9e56-8cab-4649-9df0-883ffe463396",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:37/68\nFirst Submission:2026-03-25T15:37:04.000000+00:00\nLast Submission:2026-03-29T19:42:59.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780498938",
        "uuid": "009bc4a0-60f2-402e-82fe-01b505c27bd6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780498938",
            "to_ids": true,
            "type": "md5",
            "uuid": "177f3016-8b27-4875-8f3a-277233ac2bf0",
            "value": "682db1cadcbb5f88e55c0aa3620b67db",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780497999",
            "to_ids": true,
            "type": "sha1",
            "uuid": "78678a74-4ee9-46fd-9490-14d92a77775c",
            "value": "91f263a8caa8142178de0bd90e04f9bcb589a913",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780497999",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9c46c6aa-15d8-43f2-9dd1-4b3b2b2b16af",
            "value": "8ecc7108cd679316bf5900e84f19b256dc399902cdede646493f502ac872cc1a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780496449",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8d51beae-15f4-4149-af22-60f0fdccf8eb",
            "value": "393216:Ot+PwJ+pOoObZzQ9reZ8mp2GTCgmo3bFb0T3uzditTDMLIWX6y:Ot+PwAuZLD3Q3uz8DMLIWL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780496449",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "24c67011-f210-4abd-bd91-2ea8374a697f",
            "value": "36712930"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780496449",
            "to_ids": true,
            "type": "vhash",
            "uuid": "bdf7128d-279e-412d-87a3-7f26f93c79ec",
            "value": "f5c3d983f487aec4e1219caee9656640"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780496449",
            "to_ids": true,
            "type": "filename",
            "uuid": "b59d1fda-e877-4151-92eb-978146f413c7",
            "value": "a.out"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780496449",
            "to_ids": false,
            "type": "text",
            "uuid": "55d005b0-e991-48c9-972d-d1284d5e98ba",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:22/64\nFirst Submission:2026-04-09T12:50:03.000000+00:00\nLast Submission:2026-04-21T09:26:35.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780498959",
        "uuid": "b2e420a4-8b2d-4860-8924-8170880b3e33",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780498959",
            "to_ids": true,
            "type": "md5",
            "uuid": "00986df5-ab5a-45b8-9bc5-77b11878a3ac",
            "value": "2c4fa685b655ed9f908bb173dff99552",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498000",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d415ff0c-5a84-4ab6-a6bd-f973d58a7ebe",
            "value": "d9a7daadb2e385f424b6f01a8f0774a6fddeee56",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498000",
            "to_ids": true,
            "type": "sha256",
            "uuid": "10def643-eeff-4d05-93ad-29170539948f",
            "value": "e1ce4e6222396a58d13dddfe64c1dd21f1632bcbe11d1867d44bab4fc646883a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780496470",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9e6a6f76-7ba4-4aaa-aaa3-41825005ee68",
            "value": "196608:x1V0WkAb3Ms/wpiqH5BShc7x0dKAlST+bUXj20pT7i3u5+58xyb+FDFaerd:x1V7+MqZghc7xXMST+bUXjZpvE2+Lk/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780496470",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b8cbd08c-9c9e-4003-a98f-f71534627f07",
            "value": "39772200"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780496470",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2bc5af90-2f65-4012-9a4b-f27deec09a5d",
            "value": "bb39f5a924b568b3d298aaa6f76dea54"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780496470",
            "to_ids": true,
            "type": "filename",
            "uuid": "4f05ac18-39d6-4aab-97d4-b5d690dba591",
            "value": "2026-04-12_2c4fa685b655ed9f908bb173dff99552_adload_glassworm_helldown_poet-rat_rekoobe"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780496470",
            "to_ids": false,
            "type": "text",
            "uuid": "cfd146c0-f8a3-461e-b20c-9a8d23bbd8e3",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:22/63\nFirst Submission:2026-04-10T13:13:03.000000+00:00\nLast Submission:2026-04-21T09:29:15.000000+00:00"
          }
        ]
      }
    ]
  }
}