{
  "Event": {
    "analysis": "1",
    "date": "2026-06-30",
    "extends_uuid": "",
    "info": "[Threat Intel] An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails",
    "protected": false,
    "publish_timestamp": "1783858363",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1783858363",
    "uuid": "76e68ef9-d086-4e40-97bd-79bc1cfe5359",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#f4b62b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"ValleyRAT\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782903611",
        "to_ids": false,
        "type": "link",
        "uuid": "1bde63cb-f0d1-4daf-b35d-659a1c8b93a4",
        "value": "https://www.levelblue.com/blogs/spiderlabs-blog/an-analysis-of-valleyrat-infection-campaigns-from-fake-installers-japanese-malicious-emails"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782903611",
        "to_ids": false,
        "type": "text",
        "uuid": "637b5c65-225a-45ce-8669-532cc8cb9d53",
        "value": "LevelBlue has identified two distinct ValleyRAT attack vectors: campaigns using fake installers and malicious email-based campaigns. Detection volume increased significantly from May 2025, nearly doubling in 2026. The fake installer attacks primarily target Chinese-speaking users and employ advanced techniques including Pool Party Variant 7 process injection and BYOVD methods. The malicious email campaigns target both Chinese and Japanese-speaking users, delivering ZIP archives containing EXE and DLL files that leverage DLL sideloading. The malware employs multiple evasion techniques including junk code insertion, memory size checks, sleeping duration checks, process count validation, and fileless execution using Donut-generated shellcode. ValleyRAT establishes persistence through registry modification and enables remote access capabilities for threat actors."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782903611",
        "to_ids": false,
        "type": "text",
        "uuid": "b0dd5376-0699-4c1e-8900-8c7a0b1046ac",
        "value": "Name: An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails\nAuthor: AlienVault\nAdversary: SilverFox\nTags: [\"phishing emails\", \"process injection\", \"fake installers\", \"donut shellcode\", \"japanese targets\", \"dll sideloading\", \"chinese targets\", \"valleyrat\"]\nTgtd countries: []\nMlwr families: [\"ValleyRAT\"]\nAttack_ids: [\"T1218.011\", \"T1204.002\", \"T1497.001\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1140\", \"T1055\", \"T1497.003\", \"T1112\", \"T1083\", \"T1547.001\", \"T1055.012\", \"T1027\", \"T1070.004\", \"T1027.002\", \"T1574.002\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782903611",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "26b38f81-e3d8-4e66-856b-e7481e3b6a49",
        "value": "SilverFox"
      },
      {
        "category": "Network activity",
        "comment": "ValleyRAT download URL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847272",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8b7d8dd5-1095-4980-a5a8-2fda7d34d830",
        "value": "154.92.16.22",
        "Tag": [
          {
            "colour": "#85fc9b",
            "local": false,
            "name": "asn:asn=\"142403\"",
            "relationship_type": ""
          },
          {
            "colour": "#363819",
            "local": false,
            "name": "asn:as-owner=\"YISUCLOUDLTD-HK YISU CLOUD LTD\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Domain part of the URL in the malicious email",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847293",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3660147a-aeb5-4915-b92b-5a42a0dc3d7b",
        "value": "frehf.oss-cn-hongkong.aliyuncs.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ValleyRAT download URL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847314",
        "to_ids": true,
        "type": "url",
        "uuid": "9c340a9d-d433-4a42-8a83-7d5741d1ee65",
        "value": "http://154.92.16.22/xz.bin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-02-12T01:02:01+00:00",
        "last_seen": "2026-02-12T01:02:01+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783847336",
        "uuid": "a7c64de3-ed5e-4012-a3fd-c56f7c47f6c7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Malicious email",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "md5",
            "timestamp": "1783847336",
            "to_ids": true,
            "type": "md5",
            "uuid": "4eb14f4a-e575-47d1-806d-d9168419e5ac",
            "value": "64c325c48252961f70c7d04200962263",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Malicious email",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "sha1",
            "timestamp": "1783846928",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2fe65cd2-1ce4-46c1-954b-4a631a49c04e",
            "value": "e8be03f19ada1f5cec74b143e21d4939e781671d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Malicious email",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "sha256",
            "timestamp": "1783846928",
            "to_ids": true,
            "type": "sha256",
            "uuid": "02f4c667-117b-4d03-93e9-8f49390b8f78",
            "value": "4b7bf50f2f182e8e81f2539b2f24f003f72ce4b4f1694e0461a12883da08f17a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 12/07/2026\nLast-scan: 03/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "text",
            "timestamp": "1783845884",
            "to_ids": false,
            "type": "text",
            "uuid": "0bf8f85a-830c-4675-b7d5-802da1440515",
            "value": "Malicious email\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-02-12T01:02:01+00:00\nLast Submission: 2026-02-12T01:02:01+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783845884",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2b175f38-058f-4187-90de-b13ef16ddedb",
            "value": "192:0c3pkqjlu10/98Qqmorr1WcPVocCr1F9KRZZqE0ARmAJf0fF:0+Dj/2QqfpVojrHsRZAE0Um2f0fF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783845884",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "53b412e4-2fc6-4473-aed7-2c1ff05d4b1d",
            "value": "13152"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-02-12T01:02:01+00:00",
            "last_seen": "2026-02-12T01:02:01+00:00",
            "object_relation": "filename",
            "timestamp": "1783845884",
            "to_ids": true,
            "type": "filename",
            "uuid": "98e5f8c8-eb54-4dea-a8f1-46f67f4bd0e2",
            "value": "6167JHTo82559523.eml"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-03-03T00:32:37+00:00",
        "last_seen": "2026-03-03T00:32:37+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783847357",
        "uuid": "b0173f22-a51f-4631-8cb3-6c1b273ef8bb",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "ZIP archive",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "md5",
            "timestamp": "1783847357",
            "to_ids": true,
            "type": "md5",
            "uuid": "25aa84e4-17e9-433e-9077-324ed0a861ae",
            "value": "157cbbc9b8dff9f0ffd968b0d3f4eb4b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ZIP archive",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "sha1",
            "timestamp": "1783846929",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a3c34c71-6ee0-4c5e-b2a7-866d91e25930",
            "value": "65168c8dd93b16d3b77092fb70c0fa6fba4dffcc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ZIP archive",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "sha256",
            "timestamp": "1783846929",
            "to_ids": true,
            "type": "sha256",
            "uuid": "71281fed-0511-4bb4-a9d2-ff2eaf3b2a14",
            "value": "acbcd38d83f4a057b18961dd9055e00dc0ace229b0d0f89d224f731e75c94f80",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 12/07/2026\nLast-scan: 09/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "text",
            "timestamp": "1783845906",
            "to_ids": false,
            "type": "text",
            "uuid": "099dc4ff-0ee1-4cb4-87d3-2733c958e497",
            "value": "ZIP archive\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-03-03T00:32:37+00:00\nLast Submission: 2026-03-03T00:32:37+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783845906",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6974b60c-8721-40c1-aeb6-26101a3a7d59",
            "value": "786432:lu8MIgvw9KiszS6zeL/BVLfYSqNIoMkqPCQLjQXYJ4PnnfY7LcY:s80vARHhfkSyzqTLUNnnE7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783845906",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "318c02b6-7d10-401a-8adb-45c9a837c9b4",
            "value": "32178422"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:32:37+00:00",
            "last_seen": "2026-03-03T00:32:37+00:00",
            "object_relation": "vhash",
            "timestamp": "1783845906",
            "to_ids": true,
            "type": "vhash",
            "uuid": "925d69e7-506b-4460-91bf-d8338669cbcd",
            "value": "9360af6a1782dbc0d4650e94f5cf763a"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-03-03T00:40:48+00:00",
        "last_seen": "2026-03-03T00:40:48+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1783847378",
        "uuid": "c75afb0b-09a9-48cc-b826-83b227514618",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "ValleyRAT sample encrypted by RC4",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "md5",
            "timestamp": "1783847378",
            "to_ids": true,
            "type": "md5",
            "uuid": "f87e9569-2f00-4b42-a76f-dd518b935b96",
            "value": "65af88fed6658544429c6e7cafae58d2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ValleyRAT sample encrypted by RC4",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "sha1",
            "timestamp": "1783846930",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a25e8ed1-fe72-4d8b-b8b7-d3ad08213a5b",
            "value": "eca7ed7b699835fadc2c2997a2845864e02b8dfe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "ValleyRAT sample encrypted by RC4",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "sha256",
            "timestamp": "1783846930",
            "to_ids": true,
            "type": "sha256",
            "uuid": "87fbdc67-ebe9-4d8b-a603-c49e8c97dc0b",
            "value": "36fbd24cf3208514e418f14ef4f365daa42c5a560a9ad4e07ff18037a29b26bd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 12/07/2026\nLast-scan: 06/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "text",
            "timestamp": "1783845927",
            "to_ids": false,
            "type": "text",
            "uuid": "4f97658c-46b7-46f3-a265-c3893b64c807",
            "value": "ValleyRAT sample encrypted by RC4\r\nType Description: unknown\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-03-03T00:40:48+00:00\nLast Submission: 2026-03-03T00:40:48+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1783845927",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "00ecfd35-278f-424d-81f1-424f4fbacbb1",
            "value": "6144:/D0+uQkCVqIFxfBafYOMtkazwnsQi2qyzPO3lUKdMPkkXrT9JoKT79Q+CrAo:I+ueNAfYOOXwnDK1MMSv9Jd7XOT"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1783845927",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d9b17b53-8629-4404-9e2b-08d601d287f8",
            "value": "334923"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T00:40:48+00:00",
            "last_seen": "2026-03-03T00:40:48+00:00",
            "object_relation": "filename",
            "timestamp": "1783845927",
            "to_ids": true,
            "type": "filename",
            "uuid": "fab025ae-583d-4b19-bc5b-66b0c6d886b7",
            "value": "xz.bin"
          }
        ]
      }
    ]
  }
}