{
  "Event": {
    "analysis": "1",
    "date": "2026-07-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Still Circling: Toolkit Keeps Evolving",
    "protected": false,
    "publish_timestamp": "1785033924",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785033924",
    "uuid": "6f5c1e35-e4eb-4a4c-8d0b-30817a66a88f",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#d74cce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dc839",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b96ed",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"CMSTP - T1218.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ece0df",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"",
        "relationship_type": ""
      },
      {
        "colour": "#7e341c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Users - T1564.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#370063",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Colombia\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003d",
        "local": false,
        "name": "rectifyq:sub-category=\"TA-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AsyncRAT\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Formbook\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"NjRAT\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Xloader\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:tool=\"RDP Wrapper\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"APT-C-36\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784602806",
        "to_ids": false,
        "type": "link",
        "uuid": "21573040-205f-4c6f-b7f9-6bc9cb7a79c4",
        "value": "https://www.levelblue.com/blogs/spiderlabs-blog/still-circling-blind-eagles-toolkit-keeps-evolving"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784602806",
        "to_ids": false,
        "type": "text",
        "uuid": "2b066a31-ddfd-442d-ac50-e8ebaa586255",
        "value": "Between May and July 2026, researchers tracked the Latin America-focused threat actor Blind Eagle through multiple exposed staging servers, identifying significant toolkit evolution. Four key developments emerged: a third string-obfuscation scheme featuring JavaScript with custom AES S-box substitution, a RunPE loader using bare AutoIt3 interpreter staged via GitHub, a reusable 'Photo Studio' persistence mechanism shared across three distinct toolchains, and a materially upgraded AsyncRAT variant codenamed JC-46. This enhanced RAT incorporates Windows Notification Facility process injection, custom Base28 encoding, Hidden VNC banking-fraud capabilities with browser profile cloning, and a Chrome App-Bound Encryption v20 bypass. Despite operational security weaknesses including exposed directories and hardcoded credentials, the group demonstrates selective sophistication targeting banking operations across Spanish-speaking regions."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784602806",
        "to_ids": false,
        "type": "text",
        "uuid": "ec5dbabf-c448-4532-903c-3aeb319e4afa",
        "value": "Name: Still Circling: Toolkit Keeps Evolving\nAuthor: AlienVault\nAdversary: APT-C-36\nTags: [\"hvnc\", \"njrat\", \"banking fraud\", \"vbscript dropper\", \"asyncrat\", \"limerat\", \"process injection\", \"apt-c-36\", \"chrome credential theft\", \"latin america\"]\nTgtd countries: [\"Colombia\"]\nMlwr families: [\"AsyncRAT\", \"njRAT - S0385\", \"Njw0rm\", \"LV\", \"Bladabindi\", \"LimeRAT\"]\nAttack_ids: [\"T1113\", \"T1218.011\", \"T1056.001\", \"T1059.007\", \"T1548.002\", \"T1115\", \"T1140\", \"T1555\", \"T1055\", \"T1218.003\", \"T1555.003\", \"T1125\", \"T1564.002\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1059.005\", \"T1021.001\"]\nIndustries: [\"Finance\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784602806",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "86d55a29-e3ce-4c09-bbeb-686f2e117a74",
        "value": "APT-C-36"
      },
      {
        "category": "Network activity",
        "comment": "Triple-language dropper; custom AES S-box in JS",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784901940",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4f3c1c71-5b05-42bb-bcba-abc57f92ce47",
        "value": "178.16.52.80",
        "Tag": [
          {
            "colour": "#ce048f",
            "local": false,
            "name": "asn:asn=\"209800\"",
            "relationship_type": ""
          },
          {
            "colour": "#434f78",
            "local": false,
            "name": "asn:as-owner=\"METASPINNER-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "AutoIt3 RunPE loader staged via GitHub",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784901962",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6c3462f1-25b3-4f1a-b0aa-10293c060894",
        "value": "64.89.160.17",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Custom stream-cipher loader \u2192 fileless RunPE",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784901984",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "42088721-7013-418d-a014-3feec9a61b5b",
        "value": "181.235.8.24",
        "Tag": [
          {
            "colour": "#cb9da5",
            "local": false,
            "name": "asn:asn=\"3816\"",
            "relationship_type": ""
          },
          {
            "colour": "#88699b",
            "local": false,
            "name": "asn:as-owner=\"COLOMBIA TELECOMUNICACIONES S.A. ESP BIC\"",
            "relationship_type": ""
          },
          {
            "colour": "#0e6c94",
            "local": false,
            "name": "asn:as-country=\"CO\"",
            "relationship_type": ""
          },
          {
            "colour": "#25daa8",
            "local": false,
            "name": "misp-galaxy:country=\"colombia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "JC-46 AsyncRAT C2 (DuckDNS registration pattern suggests use since at least April 2020)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902006",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1a338245-e2ac-4e4b-8e1e-cb661bd344b2",
        "value": "rema200426.duckdns.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "XOR-0xE0 + AES-256-ECB VBS dropper with self-mutation",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902028",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3f5f07a8-f405-4287-a3c3-7a643906805c",
        "value": "46.246.84.5",
        "Tag": [
          {
            "colour": "#80889f",
            "local": false,
            "name": "asn:asn=\"42708\"",
            "relationship_type": ""
          },
          {
            "colour": "#d37a62",
            "local": false,
            "name": "asn:as-owner=\"GLESYS glesys.com\"",
            "relationship_type": ""
          },
          {
            "colour": "#f213f8",
            "local": false,
            "name": "asn:as-country=\"SE\"",
            "relationship_type": ""
          },
          {
            "colour": "#c6e2d5",
            "local": false,
            "name": "misp-galaxy:country=\"sweden\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "historically resolved AsyncRAT C2 domains via frootvpn.com since at least March 2023",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902050",
        "to_ids": true,
        "type": "domain",
        "uuid": "16162cf6-1df1-4655-afcf-70df2020c101",
        "value": "frootvpn.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub repository used to stage the AutoIt interpreter and loader source",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902072",
        "to_ids": true,
        "type": "url",
        "uuid": "48addbee-021d-4ae6-bfd4-a09d1221aa2f",
        "value": "raw.githubusercontent.com/cabeto850128/comicsam",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-05-29T01:00:45+00:00",
        "last_seen": "2026-05-29T01:00:45+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784902094",
        "uuid": "46f61f6b-df6c-4433-afc9-6d1f8bde4212",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "JC-46 WNF process injector",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "md5",
            "timestamp": "1784902094",
            "to_ids": true,
            "type": "md5",
            "uuid": "0023bacd-d679-4489-bf05-b11042f5c3b3",
            "value": "3f299fc6781250647d1b05008a8acb55",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JC-46 WNF process injector",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899497",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b022b661-75d9-4d0f-b89e-28d3bb22cdcf",
            "value": "185b831ebab31df2eb67d4a5693d83e590d10f36",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JC-46 WNF process injector",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899497",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6ebb9f90-3247-43f8-9158-49b742940f1e",
            "value": "a4fbd707f4ce7ca68e6137cef1c56b6f408e5f0a0f148434d996bb98c3a21fff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 21/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "text",
            "timestamp": "1784898337",
            "to_ids": false,
            "type": "text",
            "uuid": "3e2ba904-acb8-41c4-958a-4047e54bfa1f",
            "value": "JC-46 WNF process injector\r\nType Description: Win32 DLL\nOriginal name: Paralell.dll\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2026-05-29T01:00:45+00:00\nLast Submission: 2026-05-29T01:00:45+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784898337",
            "to_ids": false,
            "type": "datetime",
            "uuid": "ee8e142b-74b7-4167-8ba7-2c6938e50119",
            "value": "2026-05-28T17:39:09+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898337",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1da50aa6-3a29-4513-9c71-ede639ed0dc0",
            "value": "1536:5E4uVxyOQJ28Wp9GEKlNKHNdeUzNhzdhHx7BXH6eJ5Ez:5E4uVIOQJjw9GEKwpNhBz9H6B"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898337",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8d0a3653-d916-47ba-9c15-09efabe18011",
            "value": "70656"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898337",
            "to_ids": true,
            "type": "vhash",
            "uuid": "04b30dff-acef-4010-85ed-1ba3442a0757",
            "value": "37403655151100a22762061"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-05-29T01:00:45+00:00",
            "last_seen": "2026-05-29T01:00:45+00:00",
            "object_relation": "filename",
            "timestamp": "1784898337",
            "to_ids": true,
            "type": "filename",
            "uuid": "0f2e09ed-2732-4787-804a-f903ad768aa1",
            "value": "Paralell.dll"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-11T17:20:41+00:00",
        "last_seen": "2026-06-11T17:20:41+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784902116",
        "uuid": "bd80fa3e-8d72-4c42-b2a2-f305aad736e4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "JC-46 AsyncRAT payload, Gen:Variant.AsyncRAT.23",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "md5",
            "timestamp": "1784902116",
            "to_ids": true,
            "type": "md5",
            "uuid": "d4b76f4b-6f43-4cbd-adf4-062a3a4d7334",
            "value": "4eb0c6d2aff2a94d3df5d4ddd8f92468",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JC-46 AsyncRAT payload, Gen:Variant.AsyncRAT.23",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899498",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b297ca6e-d267-470c-965b-6ae4d2293cfc",
            "value": "3e84054de7835d90a3b29d1d76f38efd0bbfb7ad",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "JC-46 AsyncRAT payload, Gen:Variant.AsyncRAT.23",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899498",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9af39e5b-260d-46e0-8df3-7c706a99d46a",
            "value": "a73cb9d5d46e19f3daa4a14cfe5d8fa4319a3d62452039e4972e6a316bbb26f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "text",
            "timestamp": "1784898359",
            "to_ids": false,
            "type": "text",
            "uuid": "fd217be9-f97a-4cee-8d41-df9cc0ef8971",
            "value": "JC-46 AsyncRAT payload, Gen:Variant.AsyncRAT.23\r\nType Description: Win32 EXE\nOriginal name: Client1.exe\nMicrosoft: HackTool:Win32/UACBypass.A\nClamAV: None\nVT Total Detection: 51/74\nFirst Submission: 2026-06-11T17:20:41+00:00\nLast Submission: 2026-06-11T17:20:41+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784898360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "68e8a2ba-9807-4339-9264-d9b2e8699ec5",
            "value": "2026-06-01T19:47:00+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898359",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5846b772-6a31-432f-9d14-68b79c1e6b10",
            "value": "6144:T2rr/l01X+T2ZgduogXw9eJb7Z75k6e/iElCl:Crr/l01uTsrtXpld66e/xC"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898359",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a5b0fa3b-8e8f-4f82-9aa5-733baa8c275d",
            "value": "305664"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898360",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e16adf87-2954-435f-bb4b-64f1d781bd53",
            "value": "235036551511d0910632a30423"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T17:20:41+00:00",
            "last_seen": "2026-06-11T17:20:41+00:00",
            "object_relation": "filename",
            "timestamp": "1784898360",
            "to_ids": true,
            "type": "filename",
            "uuid": "637b37a2-95a7-427a-9acc-c1be720d3108",
            "value": "Client1.exe"
          }
        ]
      }
    ]
  }
}