{
  "Event": {
    "analysis": "1",
    "date": "2026-05-26",
    "extends_uuid": "",
    "info": "[Threat Intel] Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data",
    "protected": false,
    "publish_timestamp": "1780368445",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780368445",
    "uuid": "75c62da8-6ae9-45ed-bdaa-1558105b9bf4",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7223eb",
        "local": false,
        "name": "misp-galaxy:producer=\"Fortinet\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dc839",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#c8f8ef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"PureLogs Stealer\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1a0065",
        "local": false,
        "name": "rectifyq:topic=\"crypto-related\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779937220",
        "to_ids": false,
        "type": "link",
        "uuid": "4fb31906-2fe7-4233-b086-f25aef03aa19",
        "value": "https://www.fortinet.com/blog/threat-research/phishing-campaign-deploys-javascript-driven-purelogs-variant-to-steal-sensitive-data"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779937220",
        "to_ids": false,
        "type": "text",
        "uuid": "570ce2b6-6679-4158-a9ba-469d177a293c",
        "value": "A sophisticated phishing campaign distributes a PureLogs variant through deceptive purchase order emails containing malicious JavaScript files. The attack chain employs obfuscated JavaScript that drops PowerShell scripts, which then use process hollowing techniques to inject .NET modules into legitimate Windows processes. The malware communicates with command-and-control infrastructure to download additional plugins. PureLogs collects extensive sensitive information including credentials from web browsers, cryptocurrency wallets, email clients, Discord, and various applications. It also captures screenshots, system information, and clipboard data. The collected data is compressed, encrypted with AES, and exfiltrated to remote servers. The campaign demonstrates advanced evasion techniques through fileless execution, multiple encryption layers, and abuse of trusted processes like MsBuild.exe, making detection challenging for traditional security solutions."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779937220",
        "to_ids": false,
        "type": "text",
        "uuid": "b95d638d-4ffd-4801-9b0e-cc80e77f1dd5",
        "value": "Name: Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data\nAuthor: AlienVault\nAdversary: \nTags: [\"phishing\", \"cryptocurrency wallets\", \"purelogs\", \"process hollowing\"]\nTgtd countries: []\nMlwr families: [\"PureLogs\"]\nAttack_ids: [\"T1113\", \"T1033\", \"T1218.011\", \"T1059.007\", \"T1539\", \"T1566.001\", \"T1115\", \"T1082\", \"T1005\", \"T1140\", \"T1555\", \"T1055\", \"T1218\", \"T1555.003\", \"T1041\", \"T1059.001\", \"T1566\", \"T1055.012\", \"T1027\", \"T1573\", \"T1027.002\", \"T1071.001\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300696",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e3f55627-43ce-4f39-beab-ccddfb21d016",
        "value": "77.83.39.211",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300718",
        "to_ids": true,
        "type": "url",
        "uuid": "dc002a02-b321-4cc7-b5eb-eca155b734aa",
        "value": "https://77.83.39.211:8443/application",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300739",
        "to_ids": true,
        "type": "url",
        "uuid": "c1e96c2b-53d0-4a42-a8af-18a9d53648c8",
        "value": "https://77.83.39.211:8443/filesearch/req",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300760",
        "to_ids": true,
        "type": "url",
        "uuid": "0d1424f6-dd84-4348-bf14-64cf363988ec",
        "value": "https://77.83.39.211:8443/ping",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300781",
        "to_ids": true,
        "type": "url",
        "uuid": "39c1a6b6-978b-471d-a3ba-4c2bae280391",
        "value": "https://77.83.39.211:8443/plugin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300803",
        "to_ids": true,
        "type": "url",
        "uuid": "79a9f3bf-ba78-4172-b1f8-48ed9507b00f",
        "value": "https://77.83.39.211:8443/userinfo",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300824",
        "to_ids": true,
        "type": "url",
        "uuid": "5f875b25-bf91-42a6-809e-d5c0a71afc27",
        "value": "https://77.83.39.211:8443/browser",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300846",
        "to_ids": true,
        "type": "url",
        "uuid": "00c00f5b-1428-48fc-b286-76883799bf04",
        "value": "https://77.83.39.211:8443/discord",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300867",
        "to_ids": true,
        "type": "url",
        "uuid": "567658e2-2b9b-42d5-b6d9-a45f5018a4c3",
        "value": "https://77.83.39.211:8443/crypto",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300888",
        "to_ids": true,
        "type": "url",
        "uuid": "1011a75c-db9a-4e56-9643-d6572dbfbd12",
        "value": "https://77.83.39.211:8443/finish",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 8443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780300909",
        "to_ids": true,
        "type": "url",
        "uuid": "c96554dc-e776-496e-b86b-988214b7c8b2",
        "value": "https://77.83.39.211",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780300930",
        "uuid": "4284ebe5-0adf-4bfc-8ed4-eb2ee0707507",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780300930",
            "to_ids": true,
            "type": "md5",
            "uuid": "ff2543d2-5dfb-40c1-af3f-74d3450cf72d",
            "value": "6af99d08e9295db93ad869af5ec1422e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298406",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0bb43872-f50c-459c-b3d9-14e8fc05e2be",
            "value": "cda7136e67b34757ef2688f1e168fc927f025625",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298406",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0f5e302c-c08a-4322-9661-da0d8688bc0d",
            "value": "3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296125",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "616d8daf-a393-4e43-b607-06af657b2df5",
            "value": "24576:bld6OqI4j5VjnhacrtnvbxtgNiePH+MO4kKY5VQT02sUqz6GeFRxhaYqpOJM0NMz:6Z/gwZJY1JkejEZVj9"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296125",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e4172d50-69f0-4eca-a29a-3874754fe3ae",
            "value": "3930068"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296125",
            "to_ids": true,
            "type": "filename",
            "uuid": "83f1ecbe-0c0c-4052-ba4b-fe9d374204ab",
            "value": "kpankocrs.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296125",
            "to_ids": false,
            "type": "text",
            "uuid": "20261f94-0343-4758-bc89-14f334bd337f",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/RemcosRAT.SI!MTB\nVT Total Detection:31/61\nFirst Submission:2026-03-06T08:00:24.000000+00:00\nLast Submission:2026-03-07T18:21:38.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780300951",
        "uuid": "c4de03a3-2cfe-4eb4-b757-1bb98f2979e9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "plugin module / PureLogs / zgSGkYYzqVe.dll",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780300951",
            "to_ids": true,
            "type": "md5",
            "uuid": "30d485ab-0ba6-49ee-8fec-8f3270108fa7",
            "value": "e2470b4bb66131ac43a0e7d30bb30ede",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "plugin module / PureLogs / zgSGkYYzqVe.dll",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298408",
            "to_ids": true,
            "type": "sha1",
            "uuid": "07317a3b-fc1d-4e22-b64b-03451d9bee67",
            "value": "4f2c2a808194d27992ef227c4b9134de01d051fc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "plugin module / PureLogs / zgSGkYYzqVe.dll",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298408",
            "to_ids": true,
            "type": "sha256",
            "uuid": "406b5bde-026f-4b49-a41c-53fc7339d549",
            "value": "07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296147",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "36a682e2-2df3-43e5-8c1b-821dd14e5aee",
            "value": "12288:um7NqcLZaP4MWymcMkUitzeCtOObNMZ8LR0b0rJ6sb/Shgh5/91snhNGV4vaZP:u+Nq4QFmCJUOb3R+0c4igh5l1snm4C"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296147",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "972649fd-9eff-417a-9eae-991d56dafc9c",
            "value": "1533440"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296147",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9b8d360a-2edf-4083-9154-74e8034d6c55",
            "value": "3160366d1515433429ff62542054"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296147",
            "to_ids": true,
            "type": "filename",
            "uuid": "4fad8a95-e9eb-438e-a690-0d2559500a28",
            "value": "ClassLibrary5.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296147",
            "to_ids": false,
            "type": "text",
            "uuid": "15a99883-0756-4833-8b34-5816cd2c6765",
            "value": "plugin module / PureLogs / zgSGkYYzqVe.dll\r\nType Description: Win32 DLL\nMicrosoft: TrojanDownloader:MSIL/Heracles.MK!MTB\nVT Total Detection:51/71\nFirst Submission:2026-02-17T13:36:04.000000+00:00\nLast Submission:2026-03-27T06:17:42.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780300972",
        "uuid": "86080144-09b0-4f17-810e-359475ee3e51",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780300972",
            "to_ids": true,
            "type": "md5",
            "uuid": "169b4135-714a-4c0d-afef-9ac91af6faa2",
            "value": "90ff1e814aa207a1df501267108ff8c0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298409",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5e897fe5-631a-493b-be05-ff3e3a82353e",
            "value": "fa3894345005c2d8decfb75310d03ccbb5a6eda4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298409",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5460914e-6391-4c09-b16f-472055819b12",
            "value": "670384fafb23140d96f2f8fe04a13fc8cc8e2a6e5e8c973e39b58d103c5fea92",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296170",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e110c6e4-203c-43f0-99ab-329cd04a7da7",
            "value": "24576:gO5dPFv+iUs1hY8mW0ZEwExMbJHklevLA86uAdMqHfuOm70ADk5gknmhGRtUtWC/:g0e0N0XxVDLiHjmBc1KWqfD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296170",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "33e80e50-755a-4358-bdb2-b1506dcc2089",
            "value": "2938472"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296170",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4ade8d48-b117-41a1-877d-f3cd903c94d1",
            "value": "979d1fd1cff9857d43004b4e3d84d8b4"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296170",
            "to_ids": true,
            "type": "filename",
            "uuid": "e021cadf-0e08-47a6-859e-849c989d8059",
            "value": "ps_hXYbyfSur13c_1779837854285.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296170",
            "to_ids": false,
            "type": "text",
            "uuid": "3c8dbdbc-74b1-47a5-873f-336a55474da4",
            "value": "Type Description: Powershell\nMicrosoft: TrojanDropper:PowerShell/Obfuse.SA!MSR\nVT Total Detection:31/62\nFirst Submission:2026-04-30T23:51:26.000000+00:00\nLast Submission:2026-04-30T23:51:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780300994",
        "uuid": "701660ba-fa81-4d22-925e-89283ca3f71c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "RuntimePayload",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780300994",
            "to_ids": true,
            "type": "md5",
            "uuid": "36bb9828-99e2-44b8-ae2f-6f5e9d083080",
            "value": "6fcedb03c42f59a6b9221765211803f3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "RuntimePayload",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298410",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2e9292ed-b601-47c2-aa42-5b9b3438143e",
            "value": "7c21d9304647bf23bad9d44a4cf804f60d06405e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "RuntimePayload",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298410",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6e10330a-283d-47d0-9637-d6d69ea720d2",
            "value": "b90988400cced319d260c4937f334ecc364785ed5c593cd2139965e62ca58173",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296191",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7582d07d-e269-45df-9ada-8cb0ee459a0a",
            "value": "12288:DJnlgivVrNuoWexJxEhwjwfdXu8B4uP07DP50ZP2:A+S0JxEzbJPoI2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296191",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c922cdbe-f847-4e0f-addb-ad388a1260e3",
            "value": "653824"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296191",
            "to_ids": true,
            "type": "vhash",
            "uuid": "18961949-51e7-4ffb-8400-18115e07e3c8",
            "value": "265036751511b09528800c0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296191",
            "to_ids": true,
            "type": "filename",
            "uuid": "f8b2b0f7-776f-486d-8642-e4308511199b",
            "value": "Eqxcpvgf.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296191",
            "to_ids": false,
            "type": "text",
            "uuid": "52a48834-8e11-41d4-b954-2bcdc5484d00",
            "value": "RuntimePayload\r\nType Description: Win32 EXE\nMicrosoft: Trojan:MSIL/PureLogStealer.RVF!MTB\nVT Total Detection:51/71\nFirst Submission:2026-03-06T17:55:39.000000+00:00\nLast Submission:2026-03-06T17:55:39.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780301015",
        "uuid": "0b75bcad-9287-423a-ab55-34e71cf816af",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "downloader",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780301015",
            "to_ids": true,
            "type": "md5",
            "uuid": "99564c1c-1761-4135-b026-19c1a2d03b96",
            "value": "307f19ec3ba44b31a7fb1e381c32746c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "downloader",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780298412",
            "to_ids": true,
            "type": "sha1",
            "uuid": "79b31420-d4bf-42cf-88cf-575631c065f5",
            "value": "223eedc689230208c0763be21f2cede48907dd58",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "downloader",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780298412",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e4077a6b-64b8-4b97-a9da-2bc287943279",
            "value": "e20b35a8c30e076cdd0e1df05ba1ff2e418dbd39a674f084787cc0af2fda9e95",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780296213",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "218eccc4-ee7b-44ac-9e25-c35b8a6f28fc",
            "value": "12288:UVVmUsvABBRAcKuJggj8k3ef+dx5sHpoTHD56:ESeBicKY1hM+HD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780296213",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3cc641ec-29b4-48b4-a419-200b51451cb2",
            "value": "811008"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780296213",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5757b197-0b56-4bb4-83b0-e588f79f2465",
            "value": "3850365515147031ce959101e3d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780296213",
            "to_ids": true,
            "type": "filename",
            "uuid": "d62bafdb-24ba-4221-97f7-6b4549b752a9",
            "value": "Rmiyj.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/06/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780296213",
            "to_ids": false,
            "type": "text",
            "uuid": "c9d91886-5560-4583-8893-6f31024c87b0",
            "value": "downloader\r\nType Description: Win32 DLL\nMicrosoft: TrojanDownloader:MSIL/Heracles.MK!MTB\nVT Total Detection:48/71\nFirst Submission:2026-03-10T08:21:36.000000+00:00\nLast Submission:2026-03-10T08:21:36.000000+00:00"
          }
        ]
      }
    ]
  }
}