{
  "Event": {
    "analysis": "1",
    "date": "2026-05-21",
    "extends_uuid": "",
    "info": "[Threat Intel] Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks",
    "protected": false,
    "publish_timestamp": "1780196729",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780196729",
    "uuid": "63a2d681-adb1-4ca3-a1ae-f2d332ea8de5",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a5d84",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#83e96e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Credential Access - T1212\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418821",
        "to_ids": false,
        "type": "link",
        "uuid": "6586608a-5068-4c35-9547-6b826204cd63",
        "value": "https://blog.xlab.qianxin.com/ghost-cms-mass-compromised-via-cve-2026-26980-now-fueling-clickfix-attacks/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418821",
        "to_ids": false,
        "type": "text",
        "uuid": "9dca0fcb-a45f-42c1-b8cb-d45923a856a3",
        "value": "Attackers exploited CVE-2026-26980, a critical SQL injection vulnerability in Ghost CMS, to obtain Admin API Keys without authorization and conduct mass website poisoning campaigns. Over 700 domains across multiple industries including universities, blockchain, AI, security research, and media were compromised. The attack chain involves CMS takeover, page poisoning with malicious JavaScript loaders, two-stage cloaking scripts, and FakeCaptcha social engineering to trick users into executing malicious commands. Two distinct threat groups are actively exploiting unpatched Ghost CMS installations, delivering information stealers and remote access tools. Compromised sites include Harvard University, Oxford University, and Auburn University. The attacks leverage users' trust in legitimate websites to increase success rates of ClickFix-type attacks, with payloads being dynamically distributed through Cloudflare-proxied domains."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418821",
        "to_ids": false,
        "type": "text",
        "uuid": "62df2403-7c0e-4626-908c-86ab1a9ff6f6",
        "value": "Name: Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks\nAuthor: AlienVault\nAdversary: \nTags: [\"sql injection\", \"cloaking\", \"installer.dll\", \"notepadplusplus.dll\", \"clickfix\", \"ghost cms\", \"information stealer\", \"mass compromise\", \"utilifysetup.exe\", \"cve-2026-26980\", \"fakecaptcha\"]\nTgtd countries: []\nMlwr families: [\"installer.dll\", \"UtilifySetup.exe\", \"NotepadPlusPlus.dll\"]\nAttack_ids: [\"T1218.011\", \"T1132.001\", \"T1059.007\", \"T1140\", \"T1190\", \"T1583.001\", \"T1055\", \"T1102\", \"T1583.006\", \"T1204\", \"T1059.001\", \"T1212\", \"T1547.001\", \"T1566\", \"T1027\", \"T1573\", \"T1059.003\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Education\", \"Technology\", \"Finance\", \"Media\", \"Healthcare\", \"Government\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151031",
        "to_ids": true,
        "type": "domain",
        "uuid": "f90b2c6b-e799-4274-9fb6-4f6bf4f4b677",
        "value": "jalwat.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151052",
        "to_ids": true,
        "type": "domain",
        "uuid": "37292543-a0ae-4ff2-a34c-4f15b74722b5",
        "value": "cloud-verification.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151073",
        "to_ids": true,
        "type": "domain",
        "uuid": "fb1efbc2-753d-4b51-91bf-0b5904c15576",
        "value": "script-dev.buzz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151095",
        "to_ids": true,
        "type": "url",
        "uuid": "c094de16-473b-43c2-9fd5-5b82d0f55488",
        "value": "https://clo4shara.xyz/11z77u3.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151116",
        "to_ids": true,
        "type": "domain",
        "uuid": "2131b95c-b7d4-4daf-9a89-40b4d278373a",
        "value": "clo4shara.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151137",
        "to_ids": true,
        "type": "domain",
        "uuid": "25ba41a7-320b-4d4a-82f2-f0d4b33fcb42",
        "value": "cdnupdatenews.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151158",
        "to_ids": true,
        "type": "url",
        "uuid": "1152da41-be56-488a-9606-16cfd2544c95",
        "value": "https://cdnupdatenews.top/dl?fid=38",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151179",
        "to_ids": true,
        "type": "url",
        "uuid": "f9271b74-c6e3-4ca2-8984-382f79091914",
        "value": "https://cloud-verification.com/update.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151200",
        "to_ids": true,
        "type": "url",
        "uuid": "ee5efea6-7d31-4be9-8372-613892e2630e",
        "value": "https://com-apps.cc/11z77u3.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IOC-title:Zip archive data, at least v2.0 to extract\nIOC-description:2858eea059aea9789fb32ec31c284c54030114649f29daf78a2a1bd6516092b5",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151222",
        "to_ids": true,
        "type": "url",
        "uuid": "8eba7892-4df0-40e2-a8c4-4a462faf8fcd",
        "value": "https://com-apps.cc/NotepadPlusPlus.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151243",
        "to_ids": true,
        "type": "url",
        "uuid": "ca4b455a-e75a-42aa-adc8-b4a33ecb38ef",
        "value": "https://com-apps.cc/update.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151264",
        "to_ids": true,
        "type": "url",
        "uuid": "fdc9ee25-4f26-483f-8e90-654cdec4eb2f",
        "value": "https://jalwat.com/static/uploads/campaigns/6/update.zip",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151285",
        "to_ids": true,
        "type": "url",
        "uuid": "4fc5d144-42e0-498b-8115-618be1457d9e",
        "value": "https://platecrumbs.com/11z77u3.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151307",
        "to_ids": true,
        "type": "url",
        "uuid": "4f39f3ad-43a6-418a-84f4-f373ee25e483",
        "value": "https://script-dev.digital/api/css.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151328",
        "to_ids": true,
        "type": "url",
        "uuid": "f8d0394c-21a4-4d60-960b-56ab6a12994d",
        "value": "https://staticcloudflare.pro/api/css.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151349",
        "to_ids": true,
        "type": "url",
        "uuid": "403f26c9-cc93-43cb-8e2a-6eeb3104ba57",
        "value": "https://taketwolabs.com/wp-content/NotepadPlusPlus.dll",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151370",
        "to_ids": true,
        "type": "domain",
        "uuid": "5092259a-2062-4762-9ee0-5a84ca01ec60",
        "value": "com-apps.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151391",
        "to_ids": true,
        "type": "domain",
        "uuid": "2406a77a-4b91-4230-b4cb-f809c4553d03",
        "value": "download-file.today",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151413",
        "to_ids": true,
        "type": "domain",
        "uuid": "10ded71c-d451-4919-9ead-abdb90532c77",
        "value": "platecrumbs.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151434",
        "to_ids": true,
        "type": "domain",
        "uuid": "64d534b8-ba83-4dd2-851b-8e62c05975de",
        "value": "script-dev.digital",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151455",
        "to_ids": true,
        "type": "domain",
        "uuid": "408726c0-0188-413e-b1f4-21a81b7a2596",
        "value": "script-dev.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151476",
        "to_ids": true,
        "type": "domain",
        "uuid": "16d67374-e0cb-4b62-8805-20f8653a4d9b",
        "value": "static-file.digital",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151497",
        "to_ids": true,
        "type": "domain",
        "uuid": "e119734a-9cf3-4b82-9267-a063b2c09ec1",
        "value": "staticcloudflare.pro",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151518",
        "to_ids": true,
        "type": "domain",
        "uuid": "1dd2049f-8658-4804-a04d-1139c0edf7d5",
        "value": "taketwolabs.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151539",
        "to_ids": true,
        "type": "domain",
        "uuid": "664f2861-c5d4-423d-bdf2-c08a313d238d",
        "value": "updatefile-cf.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151569",
        "to_ids": true,
        "type": "domain",
        "uuid": "4054ef91-a1be-4c85-bcf5-20a724eddfe9",
        "value": "updatefilescf.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151590",
        "to_ids": true,
        "type": "domain",
        "uuid": "765b2f8b-6d46-4991-9001-ff66159d5ff3",
        "value": "updatesecurity.pro",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780151611",
        "to_ids": true,
        "type": "domain",
        "uuid": "8509c503-4f26-4d01-a45a-d6e91a95ebc5",
        "value": "web-telegram.ug",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780141863",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "dea53851-73cf-4a8b-a65e-d8a157ea2287",
        "value": "CVE-2026-26980"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780151632",
        "uuid": "e8bc38b7-1f9c-4c04-b694-01ca1f63fbab",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780151632",
            "to_ids": true,
            "type": "md5",
            "uuid": "84f171b8-adbc-49e4-a15e-45a7aca33839",
            "value": "18a7251ddde77ed24bc54700d84d9be1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149913",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7cf44556-3ca5-45b1-b018-211e7a7e1018",
            "value": "9434fe686801742ef7d6da248fb0b900dc32208a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149913",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ff32dd3f-943f-4c13-8c10-a20020116ce1",
            "value": "b03f5eba41b74cef1ac2926d4ac13c0b7b36e3df414796b11920bb89a077de77",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147902",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fe9a2181-3f0d-4b45-8cab-b02bbd6a1aa1",
            "value": "786432:M5rDfT/RvQ2oaJQV2SuTKxstRbeI0gQSYXTzJbU4ZT2tpmqWlicqqkZ:MZT5vQnGbS5OtUIYjFbUTtpZmiTLZ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147902",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8151d13b-37db-4195-bd16-544eee308478",
            "value": "56590976"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147902",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d5bfb52a-4193-4685-a469-8b42b9f77710",
            "value": "0570b6666d5c0d5d151c00d016z699zfaz1fz2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147902",
            "to_ids": true,
            "type": "filename",
            "uuid": "3f56e4bd-c573-4035-bf14-7dc5ceea631e",
            "value": "UtilifySetup.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  27/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147902",
            "to_ids": false,
            "type": "text",
            "uuid": "1b697da9-3170-4d83-81da-765a7053a3a1",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nVT Total Detection:31/69\nFirst Submission:2026-05-01T23:31:03.000000+00:00\nLast Submission:2026-05-21T08:33:22.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780151654",
        "uuid": "782b5a82-2144-4af9-b76c-c0a85dab8e2b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780151654",
            "to_ids": true,
            "type": "md5",
            "uuid": "524af759-e6a3-4dbb-bfb0-2f1299a3f350",
            "value": "5659292833ec421da11ebde005d9c9a8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149915",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b8f7ef35-6de0-4933-abaf-01d5e2d496cd",
            "value": "adb0cb4b38ff25f26bbbcaecda58d2b0dd80dd78",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149915",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3dd5b4f7-7649-445f-b77f-eeb7d07497aa",
            "value": "3efcb0e9ec48212ac594d86542283b861bb19cdda243638ad7eaca9926e87682",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147924",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9d018c8c-5e5e-4dc4-b901-2cd921a4ffe4",
            "value": "24576:9IYS2Mr7trjfykc++h+kEW6xhnnzXsVnArBrDEjAr2aAx/VIH06iyzFM:9IYZMr7t6h+kE1/nz8VkB3JsdIU6iS"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147924",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "402d265f-0fb7-42c4-8240-ef26ab2e4b39",
            "value": "1685504"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147924",
            "to_ids": true,
            "type": "vhash",
            "uuid": "aaf5e52d-fa22-4817-9e16-d135cdc56523",
            "value": "116066657d155d055053zf2z253z59z9dzf6z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147924",
            "to_ids": true,
            "type": "filename",
            "uuid": "8f2896ec-5e59-42dc-b022-5fbf81986e30",
            "value": "installer.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147924",
            "to_ids": false,
            "type": "text",
            "uuid": "32b661a4-3854-485b-88cf-43da78a4dcf0",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:43/71\nFirst Submission:2026-05-08T16:36:50.000000+00:00\nLast Submission:2026-05-09T02:32:53.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780151675",
        "uuid": "6fe61acb-6421-4cbe-8655-c9a81a3ca43d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780151675",
            "to_ids": true,
            "type": "md5",
            "uuid": "476e8bc4-ed6d-4a9d-ad48-01fa49216f04",
            "value": "d30cc10d54ebc967c8538ff74f442eee",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149916",
            "to_ids": true,
            "type": "sha1",
            "uuid": "efe514a6-fa1d-4305-b866-778b938bad4d",
            "value": "0c15f64435efd301a4d3f80d32fdcd3fbdf3e567",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149916",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c4ab6ae2-41bb-45ad-8d4d-b1699c6d8a67",
            "value": "f94e077b169fd59831b00a9b87e9f1d77314470e1283d8fcb522e553d7da4a4d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147946",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "561eebd6-a528-4490-a4fb-d647bca946fb",
            "value": "24576:s232oQWrI9yAqZ+cjeD2HsMVPz/NkmDMjB8DEjWr2aAxbVIH06iyzFM:s2moQWrrjeD2MK/NkmsBwHs5IU6iS"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147946",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4dc6d885-276c-4a0b-aae3-b747e02fb0a6",
            "value": "1685504"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147946",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3cd49718-b482-4ae7-a0d4-ab92773900c4",
            "value": "116066657d155d055053zf2z253z59z9dzf6z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147946",
            "to_ids": true,
            "type": "filename",
            "uuid": "c6f5edb7-da6d-4c29-9afc-d2cf29f0b597",
            "value": "f94e077b169fd59831b00a9b87e9f1d77314470e1283d8fcb522e553d7da4a4d.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147946",
            "to_ids": false,
            "type": "text",
            "uuid": "759c974e-bcde-4fdd-ace3-e3c22247f5f7",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:45/71\nFirst Submission:2026-05-17T00:36:19.000000+00:00\nLast Submission:2026-05-21T08:58:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780151696",
        "uuid": "5423442a-7d71-4a9c-9b21-b0c904130734",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780151696",
            "to_ids": true,
            "type": "md5",
            "uuid": "52349ba1-af3c-44be-be19-9dccf10062d4",
            "value": "f280e12f51f996dae7fffc64a56ee527",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149918",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c4948b6d-832f-4cc7-919f-48da50abc408",
            "value": "9cbd657fcf8936692dc9be9cc2c01c2d56c368f3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149918",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a13470ad-b4df-486f-8791-ce61cbde74be",
            "value": "3cd7a6ad1df6c48afa326b64ce5370f1df568b33966218b1844dad427dcd34f6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147967",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3a35efd5-482a-45ab-8ce5-b2858fbdde8d",
            "value": "1572864:geIOcLT5IBiWVVDlI+bxW0iQrbfiKjSCc7VywGIvJL0PAWkOPo:krT5mBVVXW+SH7cwGIvJL0PL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147967",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4fc4fcad-6a02-40e1-a4a9-2d93eefa9a73",
            "value": "67313664"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147967",
            "to_ids": true,
            "type": "vhash",
            "uuid": "061e4a23-7edf-4937-83b8-4d8e0349dccf",
            "value": "d6f86715b95875b3a2b6c98e433a3439"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147967",
            "to_ids": true,
            "type": "filename",
            "uuid": "8fb19a91-5b67-4592-a73a-367aeda09bc2",
            "value": "3cd7a6ad1df6c48afa326b64ce5370f1df568b33966218b1844dad427dcd34f6.msi"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147967",
            "to_ids": false,
            "type": "text",
            "uuid": "f0e904f4-9fb3-4930-8469-abe089d99f19",
            "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:7/62\nFirst Submission:2026-03-27T18:15:36.000000+00:00\nLast Submission:2026-05-21T09:23:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780151717",
        "uuid": "22a71d95-64fa-4d62-9828-acff16cfe1a6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780151717",
            "to_ids": true,
            "type": "md5",
            "uuid": "3359c597-26eb-44b3-a7fc-3a6539f6ce7f",
            "value": "fceca579efcef09eb507c6ca977ea281",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780149919",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ab22ae45-9c35-451a-84d1-c543ca087c02",
            "value": "192132de8c704193a74a08e0af65a03dc09b22b1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780149919",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d0cb25d7-47f9-4938-a90f-a69a05e5df2c",
            "value": "89c003ab5d4f8e0c01a5dec0cbfda809ab0cdeca6134aff6e133547586dcc1d9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780147989",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b3ddec94-3719-4b8b-a779-7d8429d5b91b",
            "value": "3072:pT2qFKAj0c3lGKgfu8SX+uzuUTIZL4WCujEMK:pT2NAjkKgf/SuuzuUT+poF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780147989",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f2f84dcd-2b79-421e-a7ee-0033136ef42c",
            "value": "109494"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780147989",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0a8ff7ed-5ade-4d25-8bd8-68757ea104cd",
            "value": "998cf875a13460f320b1074d0a5932f8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780147989",
            "to_ids": true,
            "type": "filename",
            "uuid": "2692db37-be78-44ab-81ce-ec19ada112a2",
            "value": "css.js_upload_by_xlab"
          },
          {
            "category": "Other",
            "comment": "Checked: 30/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780147989",
            "to_ids": false,
            "type": "text",
            "uuid": "5061b3a0-338d-4730-8246-dcc2809f7891",
            "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:22/62\nFirst Submission:2026-05-21T10:53:09.000000+00:00\nLast Submission:2026-05-21T10:53:09.000000+00:00"
          }
        ]
      }
    ]
  }
}