{
  "Event": {
    "analysis": "1",
    "date": "2026-05-14",
    "extends_uuid": "",
    "info": "[Threat Intel] Fresh mischief and digital shenanigans",
    "protected": false,
    "publish_timestamp": "1780196726",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780196726",
    "uuid": "62c6b987-cf0c-4a4b-9c57-a5a107789688",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#8675c7",
        "local": false,
        "name": "misp-galaxy:producer=\"ESET\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d38fc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Acquire Infrastructure - T1583\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#c9dbdd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#8196ba",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"",
        "relationship_type": ""
      },
      {
        "colour": "#6fe7f4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Tool - T1588.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ab92",
        "local": false,
        "name": "misp-galaxy:target-information=\"Lithuania\"",
        "relationship_type": ""
      },
      {
        "colour": "#809a25",
        "local": false,
        "name": "misp-galaxy:target-information=\"Poland\"",
        "relationship_type": ""
      },
      {
        "colour": "#e4d611",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ukraine\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"FrostyNeighbor\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:region=\"151 - Eastern Europe\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Military\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Embedded Payloads - T1027.009\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418817",
        "to_ids": false,
        "type": "link",
        "uuid": "423b8df0-6217-4411-a598-264d017fb593",
        "value": "https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418817",
        "to_ids": false,
        "type": "text",
        "uuid": "7c3a8880-2f9d-4a40-9c50-1ff296f0b74a",
        "value": "FrostyNeighbor, a cyberespionage group allegedly operating from Belarus and active since at least 2016, continues targeting governmental, military, and key sectors in Eastern Europe, particularly Ukraine, Poland, and Lithuania. Recent activities detected since March 2026 show the group targeting Ukrainian governmental organizations using evolved compromise chains. The attacks utilize spearphishing with malicious PDF lures impersonating legitimate entities, delivering JavaScript variants of PicassoLoader downloader. The group employs server-side victim validation based on geolocation and fingerprinting before manually delivering Cobalt Strike beacons. FrostyNeighbor demonstrates high operational maturity through diverse delivery mechanisms, exploitation of legitimate services, and regular toolset updates to evade detection, while maintaining focus on credential harvesting and establishing persistent access to compromised systems."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418817",
        "to_ids": false,
        "type": "text",
        "uuid": "e4c5f515-03a6-4ae8-bd80-a256cb8dbaa4",
        "value": "Name: Fresh mischief and digital shenanigans\nAuthor: AlienVault\nAdversary: FrostyNeighbor\nTags: [\"belarus\", \"ukraine\", \"cobalt strike\", \"cve-2023-38831\", \"cyberespionage\", \"cve-2024-42009\", \"eastern europe\", \"governmental targeting\", \"spearphishing\", \"picassoloader\"]\nTgtd countries: [\"Lithuania\", \"Poland\", \"Ukraine\"]\nMlwr families: [\"PicassoLoader\", \"Cobalt Strike - S0154\"]\nAttack_ids: [\"T1053.005\", \"T1583\", \"T1036.005\", \"T1204.002\", \"T1566.001\", \"T1082\", \"T1059\", \"T1608\", \"T1057\", \"T1041\", \"T1060\", \"T1588.002\", \"T1027\", \"T1071.001\"]\nIndustries: [\"Government\", \"Defense\", \"Healthcare\", \"Manufacturing\", \"Telecommunications\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780141045",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "b9d7fe31-db4f-4c3f-95a8-ea1c103ccaca",
        "value": "FrostyNeighbor",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"FrostyNeighbor\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150561",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a1c6af7b-6019-4b5a-b3cf-30075ae720a9",
        "value": "mickeymousegamesdealer.alexavegas.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150582",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9c7d794a-876c-4bbd-866c-20d79eccdff1",
        "value": "book-happy.needbinding.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150603",
        "to_ids": true,
        "type": "hostname",
        "uuid": "580382d0-c91e-4e17-9121-b3e7f4551ebf",
        "value": "attachment-storage-asset-static.needbinding.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150624",
        "to_ids": true,
        "type": "hostname",
        "uuid": "958cfbcf-82c6-4067-8f4d-116707f7e407",
        "value": "easiestnewsfromourpointofview.algsat.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Cobalt Strike C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150646",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e6c27421-8718-4688-ace0-b32aae469be5",
        "value": "nama-belakang.nebao.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Cobalt Strike C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150668",
        "to_ids": true,
        "type": "hostname",
        "uuid": "02d1d0f0-e20d-4380-8e79-224c37e41121",
        "value": "best-seller.lavanille.buzz",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150689",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0dab4ac4-9188-4001-b86f-abb6e95f4257",
        "value": "shinesafar.sardk.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150711",
        "to_ids": true,
        "type": "hostname",
        "uuid": "bdf809c0-158a-4f15-97b5-1c9b048dbb0b",
        "value": "hinesafar.sardk.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike beacon. No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149906",
        "to_ids": true,
        "type": "sha1",
        "uuid": "49b1efac-48be-4e62-980b-d7cfd8579618",
        "value": "27fa11f6a1d653779974b6fb54de4af47f211232",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
            "relationship_type": ""
          },
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Lure RAR archive. No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149906",
        "to_ids": true,
        "type": "sha1",
        "uuid": "8e4a5889-7ff5-4c0f-aa1f-47a87f177a49",
        "value": "3fa7d1b13542f1a9eb054111f9b69c250af68643",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike beacon. No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149908",
        "to_ids": true,
        "type": "sha1",
        "uuid": "8f55144e-1ec7-4bb0-b513-52360c46f05f",
        "value": "43e30be82d82b24a6496f6943ecb6877e83f88ab",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
            "relationship_type": ""
          },
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "JavaScript dropper. No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149909",
        "to_ids": true,
        "type": "sha1",
        "uuid": "9e0f34d8-8188-46c9-b508-88099f19619e",
        "value": "4e52c92709a918383e90534052aaa257ace2780c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "JavaScript PicassoLoader downloader. No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149910",
        "to_ids": true,
        "type": "sha1",
        "uuid": "1e754a47-69d9-4478-b4db-419b7848db74",
        "value": "6fded427a16d5314ba3e1eb9afd120dc84449769",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike dropper. No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780149911",
        "to_ids": true,
        "type": "sha1",
        "uuid": "561ece99-9918-4215-92d6-820f3df89963",
        "value": "e15abee1cfde8be7d87c7c0b510450bad6bc0906",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"Cobalt Strike\"",
            "relationship_type": ""
          },
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150732",
        "to_ids": true,
        "type": "domain",
        "uuid": "a7aacd4a-b79a-460e-83a5-75f9e0e4e12b",
        "value": "exavegas.icu",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150753",
        "to_ids": true,
        "type": "url",
        "uuid": "cc546f34-3070-464e-9493-a83f6733e427",
        "value": "https://book-happy.needbinding.icu/employment/documents-and-resources",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150774",
        "to_ids": true,
        "type": "url",
        "uuid": "92fca955-857e-420d-a985-1af009fe423a",
        "value": "https://book-happy.needbinding.icu/wp-content/uploads/2023/10/1GreenAM.jpg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150795",
        "to_ids": true,
        "type": "url",
        "uuid": "d3fd4aa5-364a-496f-8e60-42d9793a677f",
        "value": "https://nama-belakang.nebao.icu/statistics/discover.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "PicassoLoader C&C server.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150817",
        "to_ids": true,
        "type": "domain",
        "uuid": "a95d07b9-449d-4bd4-8d00-f2fb70b5263a",
        "value": "mickeymousegamesdealer.al",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:malpedia=\"PicassoLoader\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150838",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fd8e8a67-c2cc-41ca-b1a7-df9fe807749f",
        "value": "static.needbinding.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780150859",
        "to_ids": true,
        "type": "hostname",
        "uuid": "dd217f70-85fd-4684-a938-b2c75e8f767e",
        "value": "view.algsat.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150880",
        "uuid": "a2cf5a8b-2a24-466b-9a22-c5d210219ecf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Lure PDF document.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150880",
            "to_ids": true,
            "type": "md5",
            "uuid": "9180749f-0595-41b0-a19b-b46ea3fd6d73",
            "value": "9d283f04f8762f0184b34bc330417d56",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Lure PDF document.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149897",
            "to_ids": true,
            "type": "sha1",
            "uuid": "42ada60d-9a65-40e2-b244-fe0807e768cd",
            "value": "4f2c1856325372b9b7769d00141dbc1a23bddd14",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Lure PDF document.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149897",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5ad96594-ff2b-4d5a-808f-06c296d9ed5b",
            "value": "a1dab59c6952e58588bc3b237323b6c3009c96f94aef069025cfbdfe0bb2a191",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147676",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "87388e43-fe89-402e-9a5a-38325c3779d1",
            "value": "12288:fv104hBRN4XLIJZVyZDkEvz8LHm6WpvnDwMVT3w/1887:32YDyXLIJWpvcHm6W9DLv87"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147676",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d62d1e6f-9297-4005-95b4-cb9fac0de379",
            "value": "622469"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147676",
            "to_ids": true,
            "type": "vhash",
            "uuid": "319bd8ee-d28c-4734-ae05-8ef6dfd999e7",
            "value": "9a1a9e24252b0c6084f92e2edd15215da"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147676",
            "to_ids": true,
            "type": "filename",
            "uuid": "e08baff3-aa09-4271-831c-d99ddd30b33d",
            "value": "53_7.03.2026_R.pdf"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147676",
            "to_ids": false,
            "type": "text",
            "uuid": "f5fd8f8e-f735-4af0-a5e1-d8d31b009571",
            "value": "Lure PDF document.\r\nType Description: PDF\nMicrosoft: None\nVT Total Detection:11/64\nFirst Submission:2026-03-12T15:07:52.000000+00:00\nLast Submission:2026-03-12T15:07:52.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150901",
        "uuid": "b24aa50e-a741-40c7-a7d6-973b52520ab4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Lure RAR archive.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150901",
            "to_ids": true,
            "type": "md5",
            "uuid": "98d3ed4f-7082-40d2-a21d-34150aecb518",
            "value": "ad42c2a4324bd555b6aecd5038ddfbff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Lure RAR archive.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149898",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7bc4e307-099a-4e70-bbae-6b661a43ca53",
            "value": "776a43e46c36a539c916ed426745ee96e2392b39",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Lure RAR archive.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149898",
            "to_ids": true,
            "type": "sha256",
            "uuid": "06aed825-4ccd-424f-8205-04e15399bb10",
            "value": "7b859ed1d379b5ecc4118df9f3de628e036c154dd69748b1505c38eaf2cf8e47",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147719",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "75124f39-a533-465c-be26-d375533c2441",
            "value": "49152:hqJiUuhYiooz2mYHPIyBmHqEGSuTK8yvFOX8pc8ETFBRj:hqieioc2jHPdsHqlpTK8QOsG79j"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147719",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fd26c448-6f57-48fe-8e2e-bc36bc85266f",
            "value": "2099651"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147719",
            "to_ids": true,
            "type": "filename",
            "uuid": "8f525fac-a1f2-4dba-bc71-24f8bf6e5bc1",
            "value": "wotzu.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147719",
            "to_ids": false,
            "type": "text",
            "uuid": "aaa1e6e2-1332-4c9d-a762-2ace82590893",
            "value": "Lure RAR archive.\r\nType Description: RAR\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:32/62\nFirst Submission:2026-03-13T07:52:48.000000+00:00\nLast Submission:2026-03-13T07:52:48.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150923",
        "uuid": "103153e0-5cd0-4284-b881-1af49059e36c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150923",
            "to_ids": true,
            "type": "md5",
            "uuid": "1b88768d-c532-42c6-8bed-d746788b69c0",
            "value": "9905e21c43a4bcdb702281f078ef4a4f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149900",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a1fe5f30-3df7-4bf1-b245-3762ffe1e387",
            "value": "7e537d8e91668580a482bd77a5a4caba26d6bdac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149900",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c2bf4a44-b415-4554-a67d-3cd781683377",
            "value": "cf635a7a9753058eb92f839686149a1d8792d2f107e78c3175a157e7f4042385",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147741",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3d188676-2004-4dab-9f7c-623bf35759ac",
            "value": "24576:cNuiStXtJ8TI7jbXV927l13d/mDWupommjIukrm+Lx6ancG6ow07xGC5Q7dvF0q5:pg"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147741",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "135d769a-8b86-4c71-bbc0-8b64d2e41303",
            "value": "6885796"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147741",
            "to_ids": true,
            "type": "filename",
            "uuid": "2bb09812-cf89-4a24-a016-65351ccd9581",
            "value": "certificate.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147741",
            "to_ids": false,
            "type": "text",
            "uuid": "1146753a-f66b-4314-af64-599220e7c56d",
            "value": "JavaScript PicassoLoader downloader.\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:31/61\nFirst Submission:2026-04-13T14:30:30.000000+00:00\nLast Submission:2026-04-14T07:23:13.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150944",
        "uuid": "f6c3d3eb-f758-48d0-a051-730a9f2ab943",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "JavaScript dropper.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150944",
            "to_ids": true,
            "type": "md5",
            "uuid": "664a2575-8f21-425b-a644-31976dadfc69",
            "value": "4fd6063141ef6edfeb23fdd8a1f97d2e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript dropper.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149901",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4dd72608-830d-4a9d-85ed-18cd3d00a8fd",
            "value": "8d1f2a6df51c7783f2eaf1a0fc0ff8d032e5b57f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript dropper.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149902",
            "to_ids": true,
            "type": "sha256",
            "uuid": "59fb9697-55fc-4915-b446-9c681d59a12f",
            "value": "1db961084b72a94fda47caa7455e41a1ad3f0ea3088cd4874e3721840e4b84d9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147763",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5135b2c2-82b3-446a-8e32-037753bd46bb",
            "value": "49152:Ztw8odOY1EihAMXaG6DESvM10PctBQE5CVtEO:H"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147763",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3b04d412-7149-40ae-b41d-6736568bc5c6",
            "value": "2813887"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147763",
            "to_ids": true,
            "type": "filename",
            "uuid": "54279302-0c8a-434e-8625-5a7ec7358341",
            "value": "53_7.03.2026_R.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147763",
            "to_ids": false,
            "type": "text",
            "uuid": "d50d4420-8ebb-4b6f-8de0-857d5a4a2d46",
            "value": "JavaScript dropper.\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:29/61\nFirst Submission:2026-05-15T01:22:05.000000+00:00\nLast Submission:2026-05-15T01:22:05.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150965",
        "uuid": "eedb3d75-7b3a-4122-b629-13019b9774be",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150965",
            "to_ids": true,
            "type": "md5",
            "uuid": "1785b09f-734c-4661-a738-b8d09be75dd9",
            "value": "5b1217ccc6fd336a1465b7ce6c395c39",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149903",
            "to_ids": true,
            "type": "sha1",
            "uuid": "28f9b40e-cc73-4f97-8a82-33d789c31448",
            "value": "b65551d339aece718ea1465bf3542c794c445efc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149903",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4a08d797-539a-479d-92f7-9789e7207b85",
            "value": "f7b2feef2ccfdaf4d0f9f42406032f5456de076fb4c2c6baa127eb7e671fed7c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147785",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ecb3a741-5dd8-468a-a03c-2089d80164c1",
            "value": "192:VCRNzDbH1+ZYpqdnhZ8GaJwaZfJDS5z4SE4FMaN7:wRNzDbHEmea6aZf28+Mo7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147785",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7800a9eb-3f9f-465c-810b-f25e040fceaf",
            "value": "9134"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147785",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b12dc21a-2714-4832-afc9-303709157ef8",
            "value": "ce74ed9b7036885b3c29acd8894e780b"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147785",
            "to_ids": true,
            "type": "filename",
            "uuid": "989bb5bf-f343-4ddc-b8a7-b690bfe24bd3",
            "value": "Update.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147785",
            "to_ids": false,
            "type": "text",
            "uuid": "596f0e61-1bf4-4dbc-a994-e78a1abe3dab",
            "value": "JavaScript PicassoLoader downloader.\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:26/61\nFirst Submission:2026-05-22T09:38:31.000000+00:00\nLast Submission:2026-05-22T09:38:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780150986",
        "uuid": "ae1fed9d-ac2d-4cb1-9567-266e67b9dfaf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Lure PDF document.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780150986",
            "to_ids": true,
            "type": "md5",
            "uuid": "76ffe5f5-ae44-4424-af35-a3a2f4a75998",
            "value": "ab1a67562a8c19aae22ad3db049d4b89",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Lure PDF document.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149904",
            "to_ids": true,
            "type": "sha1",
            "uuid": "df3b44e8-540a-4dd1-815c-f5a141736006",
            "value": "d89e5524e49199b1c3b66c524e7a63c3f0a0c199",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Lure PDF document.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149904",
            "to_ids": true,
            "type": "sha256",
            "uuid": "85071f12-2853-4952-839c-e442e36bec2e",
            "value": "904685ae9056856132b8a2837b41676fe67038558ce62b61008d31fbbf384feb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147836",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "10e58a87-4db9-48aa-9a61-6928b225e90c",
            "value": "6144:OD1Lhsgl4J0zlJwoFReWZskMuX0wzWBKQWUeClkB:611vaK6aXXdCgfC2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147836",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2c990918-da3c-45b6-b2ad-4a0225079eda",
            "value": "266798"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147836",
            "to_ids": true,
            "type": "vhash",
            "uuid": "94d64fbc-3e4b-4722-aab9-96ab38d6b8d3",
            "value": "9a1a9e24252b0c6084f92e2edd15215da"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147836",
            "to_ids": true,
            "type": "filename",
            "uuid": "6e838a37-cec7-4809-94f6-0ef34b65826a",
            "value": "Certificate.pdf"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147836",
            "to_ids": false,
            "type": "text",
            "uuid": "6aee5cc8-2b2f-408d-84df-99ff930642f3",
            "value": "Lure PDF document.\r\nType Description: PDF\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:20/64\nFirst Submission:2026-04-13T14:08:01.000000+00:00\nLast Submission:2026-05-06T12:43:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780151007",
        "uuid": "c77b0d5f-a974-4331-aad8-742fc0876ab2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780151007",
            "to_ids": true,
            "type": "md5",
            "uuid": "37f52d82-5cd8-4cfc-bd27-04c454ec18d1",
            "value": "48c1066946723823bbada44097acbac6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149904",
            "to_ids": true,
            "type": "sha1",
            "uuid": "df0d3ff1-4a01-4b72-8638-69662c53141a",
            "value": "fa6882672ad3654800987613310d7c3fbade027e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JavaScript PicassoLoader downloader.",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149905",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b931412f-01d4-4b6b-8d36-be4adfaa29c7",
            "value": "6861ccc49586bc4e41b0947ac23a47409a29569540abb4bbf35e1db23665e498",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147879",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4b1cc94a-5987-4597-b6c8-78991aac97fa",
            "value": "12288:uUFcUA5uw2BhbhE44l8ffxIpJua5vdkl9PhyCRZQDhMgbpoxi:tFsUw23bq44iCpJH5oQYZQDhMgci"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147879",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "086b9eed-fc86-4f6f-be0a-572fb19c67a3",
            "value": "680762"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147879",
            "to_ids": true,
            "type": "vhash",
            "uuid": "65661638-d269-4e75-8d80-dfde564481e8",
            "value": "660d54c6dd5fa657ea440f9448f8eb8f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147879",
            "to_ids": true,
            "type": "filename",
            "uuid": "d47c88b2-f398-44e7-8a79-01aa2564b592",
            "value": "certificate.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147879",
            "to_ids": false,
            "type": "text",
            "uuid": "99d50a47-2aaf-40b5-875a-44fe840cf3b9",
            "value": "JavaScript PicassoLoader downloader.\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:27/61\nFirst Submission:2026-03-26T12:12:53.000000+00:00\nLast Submission:2026-03-26T12:12:53.000000+00:00"
          }
        ]
      }
    ]
  }
}