{
  "Event": {
    "analysis": "1",
    "date": "2026-06-08",
    "extends_uuid": "",
    "info": "[Threat Intel] AI brands as bait: How threat actors are using the AI hype in social engineering",
    "protected": false,
    "publish_timestamp": "1781329222",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1781329221",
    "uuid": "86de1fff-8b8c-490b-b1ce-ebea2cfae891",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e96364",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Adversary-in-the-Middle - T1557\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3bc6ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#986d39",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Name Resolution Poisoning and SMB Relay - T1557.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c9dbdd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0d02a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c60dc9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1566.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#dedf36",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1584.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Vidar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002819",
        "to_ids": false,
        "type": "link",
        "uuid": "69a7d019-02ae-40d8-9b9d-f2a8ce59b96b",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002819",
        "to_ids": false,
        "type": "text",
        "uuid": "53c329fc-1394-4108-9596-4018b950b699",
        "value": "Threat actors are increasingly leveraging the global interest in artificial intelligence by impersonating popular AI platforms such as ChatGPT, Copilot, DeepSeek, and Claude in social engineering campaigns. These operations span phishing attacks, malvertising, and search engine optimization-driven tactics that ultimately lead to credential theft, financial fraud, or malware infections. Observed campaigns include ChatGPT-themed phishing collecting credit card data targeting South Africa, Claude-themed adversary-in-the-middle attacks harvesting credentials and access tokens, malvertising campaigns distributing Vidar stealer through fake AI plugin downloads, and fraudulent DeepSeek V4 installers on GitHub. The initial access broker Storm-3075 has been identified employing AI-themed malvertising, while the financially motivated actor Fox Tempest provides malware-signing-as-a-service to enhance payload legitimacy. These campaigns combine traditional social engineering tactics with AI branding to improve success..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002819",
        "to_ids": false,
        "type": "text",
        "uuid": "89493da7-7fbb-4355-b9ff-c60c8db33c19",
        "value": "Name: AI brands as bait: How threat actors are using the AI hype in social engineering\nAuthor: AlienVault\nAdversary: Storm-3075\nTags: [\"social engineering\", \"vidar stealer\", \"vidar\", \"credential theft\", \"hijack loader\", \"adversary-in-the-middle\", \"ghostsocks\", \"lumma stealer\", \"ai impersonation\", \"malvertising\", \"oyster\", \"phishing\", \"github abuse\"]\nTgtd countries: []\nMlwr families: [\"Vidar\", \"Lumma Stealer\", \"Hijack Loader\", \"Oyster\", \"GhostSocks\"]\nAttack_ids: [\"T1557\", \"T1539\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1566.001\", \"T1553.002\", \"T1608.001\", \"T1583.001\", \"T1036\", \"T1557.001\", \"T1608\", \"T1528\", \"T1204\", \"T1566\", \"T1027\", \"T1598\", \"T1204.001\", \"T1566.003\", \"T1584.001\"]\nIndustries: [\"Education\", \"Finance\", \"Technology\", \"Retail\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781002819",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "b01a3e0c-54f2-4ed4-8a75-bd10dfadf118",
        "value": "Storm-3075"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327539",
        "to_ids": true,
        "type": "domain",
        "uuid": "d1f0b164-1080-41e6-b3aa-f108a7051137",
        "value": "brokeapt.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327560",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5d449902-e2c8-4ce9-bb78-c4a6085b3de8",
        "value": "pan.rongtv.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327582",
        "to_ids": true,
        "type": "hostname",
        "uuid": "dc8758bd-4b74-48ce-8a3c-58bd32f4ec4d",
        "value": "pan.ssffaa19.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781317329",
        "to_ids": true,
        "type": "x509-fingerprint-sha1",
        "uuid": "d695b970-eb7b-4f3f-a82b-b16b3e8eb74b",
        "value": "4f5c5b3ef45cfff7721754487a86aeff9a2e6e32"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327603",
        "to_ids": true,
        "type": "url",
        "uuid": "a679b87e-64e3-4668-b7e7-0488b47d5e28",
        "value": "http://dash.awaydouble.org/0v2auth",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327624",
        "to_ids": true,
        "type": "domain",
        "uuid": "152b5bc2-97f7-49ec-a323-904caa6c8885",
        "value": "legendarytrendsbay.shop",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327645",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d8496531-6251-47c9-afdc-634a7c09e228",
        "value": "dash.awaydouble.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "71f676eb-04a3-47a4-b0b3-45711a52b5d8",
        "value": "grupoconstat.bitrix24.com.br",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327688",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6145ad5f-b9f9-443a-9339-cfa23d7fbfb2",
        "value": "servicing.pureplantcravings.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327710",
        "to_ids": true,
        "type": "url",
        "uuid": "4f08c2d1-49b5-43d3-9f8c-40c7c9f0cffc",
        "value": "https://github.com/shippingtechnologymovie/AI-techVideos/releases/download/13123/ProFluxeFlowAi-win-Setup.exe",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781327731",
        "to_ids": true,
        "type": "url",
        "uuid": "0350211f-a72a-4a33-bfa5-6a699b0d16f1",
        "value": "https://github.com/DeepSeek-V4/deepseek-V4/releases/download/deepseek-V4/deepseek-v4-pro_x64.7z",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327752",
        "uuid": "e4ac1209-ebcb-4f2c-82ca-8726e52b755f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327752",
            "to_ids": true,
            "type": "md5",
            "uuid": "63bdf0e4-4348-46a7-8ca0-07fbee1c7e68",
            "value": "93f9ffc17865d95bea51febd93114634",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323586",
            "to_ids": true,
            "type": "sha1",
            "uuid": "37eafa29-a4b4-4f29-9980-9e0f92b28d64",
            "value": "33200ea7b27c71ea06a143e2a9cd8aa47320c603",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323586",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8b3d1723-134a-4a9c-adda-738bdc82c487",
            "value": "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321940",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9bc50bb6-6d9f-45a4-bda1-190a03425829",
            "value": "1572864:hpQtgzFkwOK/aQYAVmmJ7t6lGvN1HvONPBwEURAkNZUeNsJk1ZwQixZXVmqPkku9:h+yi5K/aQYeVJ7t6lEWUEIAkNZHNx10m"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321940",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "90c71437-096f-467a-a398-61680f565ddb",
            "value": "93333333"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321940",
            "to_ids": true,
            "type": "vhash",
            "uuid": "69e1a23f-87c0-4e85-bf83-15924b139d54",
            "value": "e40c0b16d9ee855b08a53d96164264e1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321940",
            "to_ids": true,
            "type": "filename",
            "uuid": "249776fb-1320-4045-b6de-f08aee0a943e",
            "value": "f7705f07-f0ac-439c-8c56-45c4414cfdc4"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321940",
            "to_ids": false,
            "type": "text",
            "uuid": "5d11abee-fe94-46b6-aea7-a0ecef5b336f",
            "value": "Type Description: 7ZIP\nMicrosoft: None\nVT Total Detection:12/63\nFirst Submission:2026-04-24T20:49:50.000000+00:00\nLast Submission:2026-04-25T08:03:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327773",
        "uuid": "2c8a6c70-2db3-444f-8cca-efdfe6916bc9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327773",
            "to_ids": true,
            "type": "md5",
            "uuid": "f8f08427-9d37-48d9-8d80-b760ce56f7d8",
            "value": "e552b5318d3091689ce4bfbfcc7347cb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323587",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5f310818-e26a-4025-b32a-b656f6a5763c",
            "value": "30a58736384272f40086443dcb033fb544ad6128",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323587",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5b58e4dc-fc2a-4840-93da-7e5a2f22087b",
            "value": "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321963",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "380b7936-5a11-4a37-8265-1474bcb74252",
            "value": "1572864:FVW3WkopnF+XqQL9Y/K9nuK4MJEOcamBaT5H4BoYtrC4JYMYA7h:a6FIqQL94K9uK1KKmBa1Hd2y2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321963",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c3c63554-7e79-42fa-8dbb-b936e3471746",
            "value": "82138889"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321963",
            "to_ids": true,
            "type": "vhash",
            "uuid": "61aa43f4-0f23-41cd-b5e8-ec902bc3e6b9",
            "value": "e40c0b16d9ee855b08a53d96164264e1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321963",
            "to_ids": true,
            "type": "filename",
            "uuid": "a4e86ed2-5009-4772-8466-340bf39d3e8b",
            "value": "deepseek-v4-pro_x64.7z"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321963",
            "to_ids": false,
            "type": "text",
            "uuid": "919f5cf5-f526-4710-a635-01a3e4423e3a",
            "value": "Type Description: 7ZIP\nMicrosoft: None\nVT Total Detection:23/62\nFirst Submission:2026-04-26T17:02:49.000000+00:00\nLast Submission:2026-04-26T17:51:21.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327794",
        "uuid": "88ebfa61-2fda-454d-8eb0-0431f1628fc5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Shared loader, observed under multiple AI-brand lure names",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327794",
            "to_ids": true,
            "type": "md5",
            "uuid": "4488ad22-2c4d-4de8-a961-9c5245a2e418",
            "value": "5e71518ba0d8b7cba63a599c8a70276b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Shared loader, observed under multiple AI-brand lure names",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323588",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5d6751cc-03d5-411d-ae49-b304194a73a6",
            "value": "9c95c69cd7e4cbe1fa307768355f3a396868630f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Shared loader, observed under multiple AI-brand lure names",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323588",
            "to_ids": true,
            "type": "sha256",
            "uuid": "489f220a-5540-4f00-a2bc-935ee9d99af4",
            "value": "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781321991",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cead130b-59cb-418a-9de3-34cf5beba803",
            "value": "1572864:hAEyOLAs7B9ktxBpoYRS4XSJB4Gn0fXt8wrWhNExO5pSs97ORC7PX7pUecFVbuBT:hyc3UxBiGS4XOl0fXtcPd5pJ9FhUFRu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781321991",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8c130c78-52f8-4101-9662-b362612aa000",
            "value": "138232832"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781321991",
            "to_ids": true,
            "type": "vhash",
            "uuid": "abac0a29-4369-4b67-a463-0c0e587fa574",
            "value": "018076657d156d05755083zb0d00493z81z6033za032z554z137z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781321991",
            "to_ids": true,
            "type": "filename",
            "uuid": "0835afc7-530b-4f53-98b7-a082f217d42b",
            "value": "NomadAgent.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  13/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781321991",
            "to_ids": false,
            "type": "text",
            "uuid": "1eee3e93-17ac-4fd8-b18a-0c4459a3b40b",
            "value": "Shared loader, observed under multiple AI-brand lure names\r\nType Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:28/69\nFirst Submission:2026-04-12T10:02:52.000000+00:00\nLast Submission:2026-05-21T16:07:52.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327816",
        "uuid": "90cbb9c5-770e-4f86-9d0c-c17a77591083",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327816",
            "to_ids": true,
            "type": "md5",
            "uuid": "a1b3cacb-6c53-4b6a-8dd7-05a4f00cf097",
            "value": "5719a553bab3e644fd1adefea438e4e5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323589",
            "to_ids": true,
            "type": "sha1",
            "uuid": "33dc2e4e-7637-4b53-a6a6-61c1fafae7a5",
            "value": "84891e8e7bd067359b20bcfb7b3846becef93c18",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323589",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ea5c9b4d-6777-4234-8137-5aeda4a24ca8",
            "value": "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781322013",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6da056f3-9e16-4408-bd20-23d079293975",
            "value": "1572864:t1EyOLAsLRS4XSJB4Gn0fXt8wrWhNExO5pSs97ORCaPX7qUecFVbuBJT:Myc39S4XOl0fXtcPd5pJ9FLUFRu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781322013",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "69d3f7d7-b41e-4cfa-a97a-6d39e7b519da",
            "value": "127021056"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781322013",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f23a1d42-ea4b-4d95-b903-86fb9041372d",
            "value": "018076657d156d05755083zb0d00493z81z6033za032z554z137z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781322013",
            "to_ids": true,
            "type": "filename",
            "uuid": "9c318ff6-ff74-49c7-8489-161bb1c02e7c",
            "value": "VectorEngine.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781322013",
            "to_ids": false,
            "type": "text",
            "uuid": "6523bd26-bcb0-480f-94de-34954d298f5f",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:34/69\nFirst Submission:2026-04-26T14:52:13.000000+00:00\nLast Submission:2026-04-27T04:48:29.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327837",
        "uuid": "d7803054-71e3-4852-8c8d-fbfdeb364cde",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327837",
            "to_ids": true,
            "type": "md5",
            "uuid": "ee078372-6d99-4d0d-b263-708dec5a9111",
            "value": "85ba798bc28b68623234618fbaaa1733",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323590",
            "to_ids": true,
            "type": "sha1",
            "uuid": "18aa9425-36a7-4060-af04-306d75bde7bf",
            "value": "f38cffc5eeddcc1122b67bc612b1d3dfd21d3887",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323590",
            "to_ids": true,
            "type": "sha256",
            "uuid": "23181119-b1bc-4e2d-9765-16880d602c35",
            "value": "791efb555eefb7215e96659a1353a97416743b66bdd72705493129c64057d40e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781322035",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "68b19825-8bbf-49eb-9416-48eacddd4457",
            "value": "1536:w/BHomkkrcvyB6ijyqF6TDGv7RAmL9SoMx2wi4vGcYbdQ99N7NxkwaeQ1:bTyB6k6+CmLmdEbbyJjDa"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781322035",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "23f45e73-da4e-4a26-b3e9-0e81ef960e3b",
            "value": "111059"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781322035",
            "to_ids": true,
            "type": "vhash",
            "uuid": "15daa5cc-9cad-439e-8a58-b44d242845c4",
            "value": "9ca929e9a50f56ffa5a666f4120526019"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781322035",
            "to_ids": true,
            "type": "filename",
            "uuid": "888066fd-6691-4758-9118-f2a88721db19",
            "value": "Fill and Sign Claude Appeal Form.pdf"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781322035",
            "to_ids": false,
            "type": "text",
            "uuid": "923abb5c-0fd4-4549-917c-474e4e407284",
            "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:2/63\nFirst Submission:2026-04-20T14:30:58.000000+00:00\nLast Submission:2026-04-20T14:30:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327858",
        "uuid": "4dca2fb1-0fbc-4d80-9098-534601d7ac6c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327858",
            "to_ids": true,
            "type": "md5",
            "uuid": "e9779248-a15d-4c9d-b589-550811675a7a",
            "value": "65dae8b8747a4b4646317dc3d344c87a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323591",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9d92b950-d52c-423e-b3ed-a7f506fc19ac",
            "value": "5c5303c18e0b23094023399f81a40c9a5856ec2e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323592",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4c07bf38-f878-4cbe-b52e-390513821880",
            "value": "8610d4fb0ec5b525071c2aaec4df0f8fcbb3673aba58a7e1959fc44e83c0e2ca",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781322057",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5b0f3fbb-f2cd-457f-9ab8-bce25c563522",
            "value": "1572864:epQtgzFkwOK/aQYAVmmJ7t6lGvN1HvONPBwEURAkNZUeNsJk1ZwQixZXVmqPkkuG:e+yi5K/aQYeVJ7t6lEWUEIAkNZHNx10h"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781322057",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "572a0eef-b1ba-4515-9fd7-5e81f2d5a4f0",
            "value": "93333333"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781322057",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a2265350-b17e-4e03-a92f-a8f1aabe90d5",
            "value": "e40c0b16d9ee855b08a53d96164264e1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781322057",
            "to_ids": true,
            "type": "filename",
            "uuid": "eee6b04f-d9ab-4cef-8a09-54715b475494",
            "value": "deepseek-v4-flash_x64.7z"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781322057",
            "to_ids": false,
            "type": "text",
            "uuid": "802f29e2-2f80-4d9b-b736-0d4a75dc561b",
            "value": "Type Description: 7ZIP\nMicrosoft: None\nVT Total Detection:25/63\nFirst Submission:2026-04-25T02:16:44.000000+00:00\nLast Submission:2026-04-25T02:16:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327879",
        "uuid": "889ee937-49bf-4a00-a448-dea68ff3e4e2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327879",
            "to_ids": true,
            "type": "md5",
            "uuid": "4e1823a4-4e59-4df3-9fe5-ab8cea646976",
            "value": "172ad08c274a6104da7181bf85e68891",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323593",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b07cf85b-0330-432f-a928-aa24b1f8f3fd",
            "value": "0123cfe79e0e59a1d64d4a18b696e773fb804e10",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323593",
            "to_ids": true,
            "type": "sha256",
            "uuid": "71d749d7-0633-4cf5-8127-8357ed143734",
            "value": "99231deb373997364381d1eb513d2d42231d418c3a2db9007c5af9bd56ab9371",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781322079",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3c958a0f-171f-4400-a7d8-9d77a77916f8",
            "value": "1572864:8VW3WkopnF+XqQL9Y/K9nuK4MJEOcamBaT5H4BoYtrC4JYMYA7D:16FIqQL94K9uK1KKmBa1Hd2yw"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781322079",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "32ec25b7-4b26-4a34-9ca9-aadca18bb0d7",
            "value": "82138889"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781322079",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a7a4b0c0-92d6-4842-ad66-edd660ddccfc",
            "value": "e40c0b16d9ee855b08a53d96164264e1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781322079",
            "to_ids": true,
            "type": "filename",
            "uuid": "8f6eb8b0-0c05-4efa-8b54-62c6eb7dfe1f",
            "value": "deepseek-v4-flash_x64.7z"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781322079",
            "to_ids": false,
            "type": "text",
            "uuid": "2da51a29-901d-413d-a9cb-94de425f6b5b",
            "value": "Type Description: 7ZIP\nMicrosoft: None\nVT Total Detection:23/62\nFirst Submission:2026-04-27T02:26:42.000000+00:00\nLast Submission:2026-04-27T02:26:42.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781327900",
        "uuid": "a1a87b93-c71c-4d7f-97dc-a25bbc178ef6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781327900",
            "to_ids": true,
            "type": "md5",
            "uuid": "1411767d-b696-47a3-aeef-8d158dada9d3",
            "value": "f6f38d06c003cfc1b8727aaa7ef0d0fe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781323594",
            "to_ids": true,
            "type": "sha1",
            "uuid": "502dfab1-da8a-4d40-8fd6-60be7069e31b",
            "value": "6c7c698519d5f1d5a47aa12fd5deabd81a78031b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781323594",
            "to_ids": true,
            "type": "sha256",
            "uuid": "df89623d-ae3d-4338-997c-61193923b5d5",
            "value": "c7c5072df9f83f4c440a5c3bb4be1d5f6c67bbf78f196406ca20d27b43b975b8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781322100",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cda9736e-cf34-48e8-96be-a0f3a043f74b",
            "value": "3145728:nlfv8uwd0MK6aH5Y3pK2+G42nlshsCEOxLDrJ8UpNc:2dK6aH5epK2+JylIRLpzpW"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781322100",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "20d4beda-2bb5-496e-b31c-f79052a641c0",
            "value": "117957432"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781322100",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f83d4dc3-d29e-42e0-8b5b-94d1c12d84da",
            "value": "018066655d1d05556az953z6gz2dfz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781322100",
            "to_ids": true,
            "type": "filename",
            "uuid": "cd8ae40f-380c-48bf-b784-2a870c4b5f25",
            "value": "ProFluxeFlowAi-win-Setup.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/06/2026\nLast-scan\t:  11/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781322100",
            "to_ids": false,
            "type": "text",
            "uuid": "9f2049f5-daf6-4832-9e87-a973851cf5a7",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Malcert\nVT Total Detection:30/70\nFirst Submission:2026-03-13T21:38:03.000000+00:00\nLast Submission:2026-05-24T04:15:00.000000+00:00"
          }
        ]
      }
    ]
  }
}