{
  "Event": {
    "analysis": "1",
    "date": "2026-05-27",
    "extends_uuid": "",
    "info": "[Threat Intel] Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant",
    "protected": false,
    "publish_timestamp": "1780377479",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780377479",
    "uuid": "8852557e-67b3-41c3-a52f-51232fc96b30",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Kimsuky\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"South Korea\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Military\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#17c030",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Window Discovery - T1010\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clear Persistence - T1070.009\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command Obfuscation - T1027.010\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e51c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Process with Token - T1134.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#cb2c9b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Embedded Payloads - T1027.009\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0fe1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780110007",
        "to_ids": false,
        "type": "link",
        "uuid": "5327c58e-c3bf-46e3-bd89-b6753eef5fce",
        "value": "https://www.enki.co.kr/en/media-center/blog/kimsuky-s-advanced-attack-techniques-jsonping-webex-spoofing-and-a-new-httpspy-variant",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780110007",
        "to_ids": false,
        "type": "text",
        "uuid": "15394013-2005-41eb-9eb6-34f8152c729c",
        "value": "Through April 2026, Kimsuky deployed sophisticated malicious campaigns against South Korean military and corporate entities using tailored social engineering tactics including fake security software installation pages and spoofed Webex meeting pages leveraging legitimate meeting schedules. The threat actor introduced a novel JSONPing technique allowing distribution pages to verify in real time whether victims executed the payload via JSONP queries to localhost servers. Analysis revealed a new HttpSpy variant with a three-stage execution chain replacing the previous single-binary architecture, utilizing RC4 encryption and shared infrastructure indicators. Attribution was confirmed through code pattern overlaps, reused encryption keys, XAMPP certificate fingerprints, and preferred ASN usage consistent with historical Kimsuky operations targeting South Korea."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780110007",
        "to_ids": false,
        "type": "text",
        "uuid": "4e74e00a-0c12-4c06-b560-035c67d9fca3",
        "value": "Name: Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant\nAuthor: AlienVault\nAdversary: Kimsuky\nTags: [\"spear phishing\", \"httpspy\", \"webex spoofing\", \"loaddll.dll\", \"south korea targeting\", \"memloader\", \"jsonping\", \"calc.exe\", \"social engineering\", \"kimsuky\", \"spyloader.dll\", \"rat\", \"spyinster.dll\"]\nTgtd countries: []\nMlwr families: [\"HttpSpy\", \"MemLoader\", \"calc.exe\", \"spyInster.dll\", \"spyLoader.dll\", \"loadDll.dll\"]\nAttack_ids: []\nIndustries: [\"Defense\", \"Finance\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780110007",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "760ce93b-d29d-4a69-9df1-8a39230a9e71",
        "value": "Kimsuky"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373857",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a0c2108c-e46b-4637-a10d-ca1ea5e87765",
        "value": "load.serverpit.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373878",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c27ad0ed-5fd1-4625-97aa-2575cf265bb5",
        "value": "load.erasecloud.n-e.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370760",
        "to_ids": true,
        "type": "md5",
        "uuid": "8ed5e1a8-d684-4155-85ae-0398ba570299",
        "value": "a2547836564b0732c6d02a78702da7e6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370762",
        "to_ids": true,
        "type": "md5",
        "uuid": "c0166b02-806a-448a-8a09-9f7cbfb4a214",
        "value": "a87cd5fd8fe223816005e81e0da70b21",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370762",
        "to_ids": true,
        "type": "md5",
        "uuid": "edd81ed1-3bde-43e2-a13e-15a20cfb1f8d",
        "value": "b4dd4c76d7deef4cf532e240b7f84c9d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370763",
        "to_ids": true,
        "type": "md5",
        "uuid": "33f269d5-25a8-403c-8a0f-20b3971480c9",
        "value": "bd8e948a6e61436532cd2ed2b62db3f3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370764",
        "to_ids": true,
        "type": "md5",
        "uuid": "a854b8b3-dbe8-4df4-af93-5af54ab99cf8",
        "value": "be31a38bab026f229afd5e3174c363f7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370765",
        "to_ids": true,
        "type": "md5",
        "uuid": "7c7474d1-9a60-4563-8b05-3d702e485673",
        "value": "be978477fe7c179cb9607a6e08a05dff",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370765",
        "to_ids": true,
        "type": "md5",
        "uuid": "0acd44e9-557f-4da5-96bc-c3c875ffe237",
        "value": "bea602695d58cbf25fff058834e36c1d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370767",
        "to_ids": true,
        "type": "md5",
        "uuid": "6eb92d98-6e2d-4488-9deb-9d0477aa5d6d",
        "value": "c05f074c70a6cacb0e6f05578aab3c9d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370768",
        "to_ids": true,
        "type": "md5",
        "uuid": "6d0fc73e-b231-45a2-8c9e-41ad0646aade",
        "value": "c61a6efe1a169c6c1d8595af3ff0dd74",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "engine.dat (spyInster.dll) No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370768",
        "to_ids": true,
        "type": "md5",
        "uuid": "fd9a7499-51ad-4ddb-8a79-1cc71f7099d1",
        "value": "c6de1be41dcfbad9cae76c58eae7f5a3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370769",
        "to_ids": true,
        "type": "md5",
        "uuid": "18ea5f98-9924-4dfb-a49d-6a4299b13cb5",
        "value": "cc837d2b2af4bd9c1c3faf61cefeb848",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370770",
        "to_ids": true,
        "type": "md5",
        "uuid": "3a5c064a-2fa7-4b4d-b16c-b6e6be34643b",
        "value": "ea5f32e1273ec93d43ee09a337fb60e1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370771",
        "to_ids": true,
        "type": "md5",
        "uuid": "e90f6188-ea7b-4807-bd61-7c73ca04bdce",
        "value": "fcaf03060e34a73fe499b906492d9f13",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373899",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "82a40e3e-4740-495d-97ad-b7a15ff034ee",
        "value": "157.250.202.123",
        "Tag": [
          {
            "colour": "#0ec520",
            "local": false,
            "name": "asn:asn=\"26666\"",
            "relationship_type": ""
          },
          {
            "colour": "#b6feca",
            "local": false,
            "name": "asn:as-owner=\"INTERSERVER-LAX\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373921",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "783115dc-b382-48ea-a5a5-e5d45c45bdff",
        "value": "27.102.113.106",
        "Tag": [
          {
            "colour": "#13ee90",
            "local": false,
            "name": "asn:asn=\"45996\"",
            "relationship_type": ""
          },
          {
            "colour": "#612cb5",
            "local": false,
            "name": "asn:as-owner=\"DAOU-AS-KR DAOU TECHNOLOGY\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373942",
        "to_ids": true,
        "type": "url",
        "uuid": "63f0b97b-1561-4ce1-a0e0-17c5d1733bdb",
        "value": "http://appview.imagetemplate.com/gateless_icon",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373963",
        "to_ids": true,
        "type": "url",
        "uuid": "96527014-2b86-4d04-acf2-5c9503a1544c",
        "value": "http://bigfile.jaycloudlab.com/download.php?id=745896",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373984",
        "to_ids": true,
        "type": "url",
        "uuid": "c5ecf19c-f2e8-4269-847f-c1979cc6d3bf",
        "value": "http://download.birdriver.org/download.php?id=393156",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374006",
        "to_ids": true,
        "type": "url",
        "uuid": "93309da0-20de-489e-8c73-7d757568efd1",
        "value": "http://hdrgdrfes.chickenkiller.com/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374027",
        "to_ids": true,
        "type": "url",
        "uuid": "4a6750ca-0fe4-4e18-9ebd-c33be38c7a7f",
        "value": "http://load.erasecloud.n-e.kr/login.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374048",
        "to_ids": true,
        "type": "url",
        "uuid": "80a4f8c1-20b2-4080-9d0b-faef485c3b5d",
        "value": "http://load.serverpit.com/fwrite.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374069",
        "to_ids": true,
        "type": "url",
        "uuid": "ba742976-5284-4290-953f-78a4592b5d1d",
        "value": "http://pipeline.embeddedonline.org/check.php?x-csrf-token=gateless",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374091",
        "to_ids": true,
        "type": "url",
        "uuid": "c9cf4b4e-47e2-4574-bbc5-90bbc522686d",
        "value": "http://pipeline.embeddedonline.org/download3.php?sessid=54126&user-token=gateless",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374112",
        "to_ids": true,
        "type": "url",
        "uuid": "7501c345-1aa5-4442-b0bc-b4ef87b00b77",
        "value": "http://www.ibizplus.n-e.kr/download.php?id=30382119",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374133",
        "to_ids": true,
        "type": "url",
        "uuid": "8d76ba70-03de-4b22-ac41-1a57d5ee5b11",
        "value": "http://www.ibizplus.n-e.kr/download.php?id=30382120",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374155",
        "to_ids": true,
        "type": "url",
        "uuid": "f2e85a26-a287-4123-b714-aa7ee36a0f45",
        "value": "http://www.ibizplus.n-e.kr/download.php?id=30382121",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374176",
        "to_ids": true,
        "type": "url",
        "uuid": "1ba67775-b456-40a0-bc49-c16609adb623",
        "value": "https://appview.imagetemplate.com/babymetalsave_icon",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374197",
        "to_ids": true,
        "type": "url",
        "uuid": "686690fb-f461-4080-bc44-395293dfe834",
        "value": "https://appview.imagetemplate.com/gateless_icon",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374218",
        "to_ids": true,
        "type": "url",
        "uuid": "c9b17a9b-fa3d-4854-b870-29729ecf9a89",
        "value": "https://bigfile.crabdance.com/recaptcha.html",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374240",
        "to_ids": true,
        "type": "url",
        "uuid": "1f750c05-178e-4c55-8968-c0fe45e4c8da",
        "value": "https://conference.birdriver.org/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374261",
        "to_ids": true,
        "type": "url",
        "uuid": "d42ff9b0-7154-413b-9a79-9b47458b08bb",
        "value": "https://download.birdriver.org/download.php?id=393156",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374282",
        "to_ids": true,
        "type": "url",
        "uuid": "06df0903-27ec-4339-82e1-0f77da6cba98",
        "value": "https://download.birdriver.org/download.php?id=425623",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374303",
        "to_ids": true,
        "type": "url",
        "uuid": "7973f2f8-f3c2-48a1-884b-275b6fdccce5",
        "value": "https://load.erasecloud.n-e.kr/login.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374324",
        "to_ids": true,
        "type": "url",
        "uuid": "2b5fdaf6-a5de-4c03-9f1e-3bcf55e26c3d",
        "value": "https://load.serverpit.com/fwrite.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374345",
        "to_ids": true,
        "type": "url",
        "uuid": "d20f54c4-9433-4041-be0c-ee76667a05ce",
        "value": "https://pipeline.embeddedonline.org/check.php?x-csrf-token=babymetalsave",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374366",
        "to_ids": true,
        "type": "url",
        "uuid": "9501a8b9-691e-44f1-9c48-b3ca381b57b8",
        "value": "https://pipeline.embeddedonline.org/check.php?x-csrf-token=gateless",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374387",
        "to_ids": true,
        "type": "url",
        "uuid": "513fbd2b-8309-436a-aa7c-11807c64559f",
        "value": "https://pipeline.embeddedonline.org/download3.php?sessid=54126&user-token=babymetalsave",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374408",
        "to_ids": true,
        "type": "url",
        "uuid": "8a190436-c922-4fa1-b1df-b08b017e7b69",
        "value": "https://www.ibizplus.n-e.kr/install.html",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374429",
        "to_ids": true,
        "type": "hostname",
        "uuid": "13788ce7-c13d-49f1-b565-f0818fe29c6e",
        "value": "appview.imagetemplate.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374450",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a6a9d623-9f91-44a9-b858-a697ed688abb",
        "value": "bigfile.crabdance.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374471",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a279b93a-5f24-4ff1-979c-b14d0dcbab78",
        "value": "bigfile.jaycloudlab.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374492",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d9d53e21-1024-4d8f-88fa-ad24f08992ce",
        "value": "conference.birdriver.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374513",
        "to_ids": true,
        "type": "hostname",
        "uuid": "19532310-3a12-4b58-bc5b-37955b690b7a",
        "value": "download.birdriver.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374535",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e42805f1-4f02-459e-beca-677a9ad5c873",
        "value": "hdrgdrfes.chickenkiller.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374556",
        "to_ids": true,
        "type": "hostname",
        "uuid": "17736a9c-43b3-49c3-abef-3e9a5b47d238",
        "value": "pipeline.embeddedonline.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374577",
        "to_ids": true,
        "type": "hostname",
        "uuid": "07a5bb00-3cc1-423c-8640-966bf676c21f",
        "value": "www.ibizplus.n-e.kr",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370772",
        "to_ids": true,
        "type": "md5",
        "uuid": "247c59e8-ab31-4562-abde-f5264cfa5b48",
        "value": "4a476abcf741323b367eda0ec49f8c38",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370773",
        "to_ids": true,
        "type": "md5",
        "uuid": "9f6c29d4-0acf-4394-b8a5-d061b4230c27",
        "value": "0d07fb6d1a3736ea543ab8364115e435",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370774",
        "to_ids": true,
        "type": "md5",
        "uuid": "50b82768-9698-42de-8136-aa4c4d7316b3",
        "value": "6d2dfd7ca77530afec000a197d6b8677",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370775",
        "to_ids": true,
        "type": "md5",
        "uuid": "a568f617-a473-435d-8aeb-a787dfce7dcf",
        "value": "50f619aaba1d28882022ced135b13a07",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Webex Phishing Page No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370776",
        "to_ids": true,
        "type": "md5",
        "uuid": "adeaf448-6a57-4b56-90cb-3ed29fced483",
        "value": "9df5ca76ac085b89c1ddcb3963e9fe97",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370777",
        "to_ids": true,
        "type": "md5",
        "uuid": "8d3888bb-cd04-4021-a346-1513684c9258",
        "value": "8833a270ddef0f464d5916958b6778e6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370778",
        "to_ids": true,
        "type": "md5",
        "uuid": "2576eb39-9de8-4e7d-802e-2d72aca435db",
        "value": "3369b911cf3706a2660d2af9b3c35f9a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370780",
        "to_ids": true,
        "type": "md5",
        "uuid": "47e981e1-d363-4b85-afc5-e981eea8d709",
        "value": "00fd7272f9a3044b5f62680d9e576e55",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370780",
        "to_ids": true,
        "type": "md5",
        "uuid": "cc3fcd4f-7632-495e-b10e-f2892ea3ca76",
        "value": "3315229011b2fa2b05bd4c7b4fbb58e3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370781",
        "to_ids": true,
        "type": "md5",
        "uuid": "9e602f5a-ad0d-40eb-83a2-a94393f61ea5",
        "value": "1efaf988fded55cd3b974c66f4ca8f7e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370782",
        "to_ids": true,
        "type": "md5",
        "uuid": "656dccb4-52d2-4b74-b57f-eddd91c1c5bc",
        "value": "50e89a4e50392e4235822e9e92df4c32",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370782",
        "to_ids": true,
        "type": "md5",
        "uuid": "95e81471-139a-4309-98d5-54de5b91ccdf",
        "value": "7b9484d719f39faa71abd90f57525cc8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "cache.db (spyInster.dll) No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370783",
        "to_ids": true,
        "type": "md5",
        "uuid": "ae113ca1-091f-4a27-bf0a-e4a23798eca2",
        "value": "91d1a7153606dedef92502553962cf67",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374598",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a56edd35-a86b-4b4b-9ae3-e437abe94e6d",
        "value": "163.245.221.218",
        "Tag": [
          {
            "colour": "#c5b4f1",
            "local": false,
            "name": "asn:asn=\"17\"",
            "relationship_type": ""
          },
          {
            "colour": "#b73c73",
            "local": false,
            "name": "asn:as-owner=\"PURDUE\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374619",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c4f9c2d0-35a0-488f-89a2-cdca00b140a9",
        "value": "163.245.215.46",
        "Tag": [
          {
            "colour": "#c5b4f1",
            "local": false,
            "name": "asn:asn=\"17\"",
            "relationship_type": ""
          },
          {
            "colour": "#b73c73",
            "local": false,
            "name": "asn:as-owner=\"PURDUE\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780374640",
        "to_ids": true,
        "type": "url",
        "uuid": "5a5a0a50-0796-4d0a-8f92-be9cdc141bd8",
        "value": "https://meet1754245389211-9925.webex.com/meet1754245389211-9925/j.php?MTID=mb755b0b9133ae8f9e3608b0b519d6a35",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374662",
        "uuid": "2d898995-de36-4e4c-bb45-80cc7ff81b4e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374662",
            "to_ids": true,
            "type": "md5",
            "uuid": "50c8fee5-1034-4dd7-87c7-67233d416106",
            "value": "d09c0744273355b6da719fdb62923bed",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370751",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d40f1dc7-43e0-40f7-8512-9fb5edba383b",
            "value": "364cc871e66afe65e1845205105c3f53f34afc01",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370751",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1b4d117f-0a47-49c9-8ded-572f29b2921f",
            "value": "c089457d5f4b22313b927bb36a320f8d7a1ddb6d5b82293dc2374dcfd4b1b8b2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369320",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "593ed9ee-4ee0-4d9d-aee2-abb7a85ada25",
            "value": "12288:h0f1YHmhSxXPDr8YaB5nOqLaxuC2OUkDTgTtjDw9bRj3bUfnyGBiuz1kfgjd1A:VSsr8RBh9bCtUSGt2Rj3bcnHipgjk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369320",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b17c9443-dfa2-402d-9038-b5e3ada40d1d",
            "value": "644608"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369320",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9d819cd2-7678-4230-98d5-095ee9dc980c",
            "value": "065076655d755515755018z4fhz1lz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369320",
            "to_ids": true,
            "type": "filename",
            "uuid": "86996bc6-02a0-48ca-80bf-27c52da4b4ae",
            "value": "2026-02-25_d09c0744273355b6da719fdb62923bed_cobalt-strike_icedid_satacom_stealc_vidar"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369320",
            "to_ids": false,
            "type": "text",
            "uuid": "1425ea40-27a2-41e9-8f9c-a12a83aa9509",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:48/71\nFirst Submission:2026-02-25T05:13:37.000000+00:00\nLast Submission:2026-03-06T13:47:59.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374683",
        "uuid": "3d0cd915-2207-4eae-9c23-8e8351dfb442",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374683",
            "to_ids": true,
            "type": "md5",
            "uuid": "4ebaf74e-566e-42e0-bfd9-0684b11e3f9a",
            "value": "a581fdea0970f8a5b6cfec4853c802d7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370752",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6a6aade8-ff9a-4377-90d6-7efe78f9bfd4",
            "value": "c124f019ddaef2606a7394b0b9bf7ae1a05ecda4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370752",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a52a2a6c-0386-4a06-a2ee-cc1a224e82a4",
            "value": "784d9273c75e983f2b4730d1f2198cc44e9599709f4a5519a2bd3049095dc9d5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369341",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c8f02625-d879-4c91-b0e9-ed17f07ddb0e",
            "value": "3072:r8uRux1zGhU6wibMK3Smb7+i03euYgstymoxSbwXckl34BJA:DAoUAbMK3XqzfTmMg+"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369341",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0d3c9363-cea6-4fc0-b714-37a89b595c87",
            "value": "237568"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369341",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c6b88df5-d166-43a5-9571-ab6b85785756",
            "value": "125076655d155515155095z80066hz10101041z21z56z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369341",
            "to_ids": true,
            "type": "filename",
            "uuid": "058380fa-724a-4ea8-9944-89afcae97e25",
            "value": "br50eefk.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369341",
            "to_ids": false,
            "type": "text",
            "uuid": "552ef7ca-1fd8-46cd-9c8a-54e916882ce0",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:50/71\nFirst Submission:2026-04-28T00:18:13.000000+00:00\nLast Submission:2026-04-28T00:18:13.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374704",
        "uuid": "92d273be-4cbc-4ef4-90c3-3f03742d4560",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374704",
            "to_ids": true,
            "type": "md5",
            "uuid": "45800b4d-9866-4944-8e33-a2bcf7f8fc8f",
            "value": "dd47c97b44408e0a5ecd8f482fcd0dbc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370753",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a868e721-4ee1-4c55-9e36-7659400e2617",
            "value": "2acb22d5edc73db031d94ec7224c33ff649aef39",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370753",
            "to_ids": true,
            "type": "sha256",
            "uuid": "26ec7833-040d-4585-b0b6-d0f75f07d34c",
            "value": "1d8e50ec756e88025c5248cfaa6ee707348310b38671ab05b27d9194a609f96d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369595",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f1ced174-b038-4075-8189-98a9cd95f607",
            "value": "12288:zRhzxiIhdlNamxAzIczPN+aqaTwl9yPb:zRhtdWJ1f0l98b"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369595",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "11196032-1db9-4be3-9684-644ae58f4459",
            "value": "398336"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369595",
            "to_ids": true,
            "type": "vhash",
            "uuid": "09c06515-c867-4c6a-bc3d-e34aa6aa5343",
            "value": "135076655d555515155018z5fnz11z2az1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369595",
            "to_ids": true,
            "type": "filename",
            "uuid": "c9c662b4-5045-4038-9040-7697a31ce75c",
            "value": "localfile~"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369595",
            "to_ids": false,
            "type": "text",
            "uuid": "0341cea5-5c57-4264-ae54-0aaa1462305e",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:49/71\nFirst Submission:2026-02-27T03:19:11.000000+00:00\nLast Submission:2026-02-27T03:19:11.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374725",
        "uuid": "a00b077a-d5eb-41c3-a823-9070baf40e17",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Malware using hwp decoy file",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374725",
            "to_ids": true,
            "type": "md5",
            "uuid": "ae0d7c29-ee3b-496e-8eb8-4e3b77644753",
            "value": "f57a9e973e1cecd6b361467041e464f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Malware using hwp decoy file",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370754",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a303bbad-2d7a-46cb-bcd1-7cac0dbb658d",
            "value": "b44e800436b2892f7c8f9fbd93e5e17a2e1fde04",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Malware using hwp decoy file",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370754",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6a403283-d4fe-4d38-b553-d39de626ab77",
            "value": "ca42cba2782a0b6952dd0425fa08cbd4de65f77fcc00e965ee97c39bea42eb18",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369638",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7a7937ba-ab69-4d8c-bddb-3d7090f1614a",
            "value": "12288:YMgXwNZJsZIOOZ9rXTCOB6DW8VgYpo2LXCBBG95R7DnOpWRZ8F:YI8wrXTCO0ZalBM/FDOkRZ8F"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369638",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b6bb1b10-42d1-44c6-b418-cc2624b75e1f",
            "value": "889856"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369638",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c7f171b1-e54e-4ef1-8572-5353930f5295",
            "value": "085076655d755515155018z4fhz13z1fz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369638",
            "to_ids": true,
            "type": "filename",
            "uuid": "8ce48a8c-9d47-4a2b-8a35-4b8c2c0fffc4",
            "value": "u33scid4q.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369638",
            "to_ids": false,
            "type": "text",
            "uuid": "7d7f8c63-e237-40bd-823a-7e2d82d2cc54",
            "value": "Malware using hwp decoy file\r\nType Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:50/71\nFirst Submission:2026-03-06T11:01:14.000000+00:00\nLast Submission:2026-03-06T11:01:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374746",
        "uuid": "32e63fec-2eaf-4881-9280-f88584a3695e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374746",
            "to_ids": true,
            "type": "md5",
            "uuid": "b3986c0b-f5db-4c69-b3e4-d7d9ad7a8b3f",
            "value": "00f957b7dafd8d210e717041add02eab",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370755",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8a730ada-50a6-463b-9cac-41cffd478440",
            "value": "ade12bc8b28984f080b799d2e9616a64c8d5856f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370756",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4a6231a3-b288-40a1-9c98-90ec414eb932",
            "value": "9fd46aa45ac8539cd288b744730661b3b27b00047bbb994e6a12b8da82d2b3e3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369702",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "588fe9c7-d0ba-47c4-afba-27630532dc71",
            "value": "786432:9tyBQOVVesQL1eorrEVlsWY84pW/DBCvSrjWE:TeesQharYHvmWE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369702",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7ac369d9-5342-49c3-ae8f-2c862468adba",
            "value": "28380120"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369702",
            "to_ids": true,
            "type": "vhash",
            "uuid": "95223098-feed-4507-9b7e-b8a008f75f5a",
            "value": "027056655d1c0510d043z800417z47z62z41fz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369702",
            "to_ids": true,
            "type": "filename",
            "uuid": "3f6f84f7-3a47-4a3f-93fb-32fde17d502a",
            "value": "nProtectOnlineSecurity.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369702",
            "to_ids": false,
            "type": "text",
            "uuid": "830ad191-83a0-4254-a9f3-425671f129b0",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:0/71\nFirst Submission:2025-03-20T04:04:21.000000+00:00\nLast Submission:2026-06-01T08:59:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374767",
        "uuid": "c74cbdd1-59f3-4840-9e1d-3ab8f57935fc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374767",
            "to_ids": true,
            "type": "md5",
            "uuid": "51e93a6f-6cc4-4b65-93e7-dc62eb564088",
            "value": "97b4c2e67e5e18b70949690a69820c2a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370757",
            "to_ids": true,
            "type": "sha1",
            "uuid": "126a6db2-a4c4-49a7-a554-dd16128cf5e7",
            "value": "3e019112dc00c4a1f14474ea6db68f35674a6efa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370757",
            "to_ids": true,
            "type": "sha256",
            "uuid": "36b3ecb8-04ba-40cd-8aa7-b6d9d252cc6e",
            "value": "144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369724",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "85ecbe4a-460d-44aa-8113-f6c3543fdd97",
            "value": "3145728:SVAgMHibxAx1vEhv663ebGqdYM75rEMNvi9vr5I7Z:MAXC9upT6OqqdYiEOvipq9"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369724",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9f2a54a7-002d-4e28-8131-6c07483f52d3",
            "value": "103097736"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369724",
            "to_ids": true,
            "type": "vhash",
            "uuid": "919c649f-7f61-4f0b-b686-bf5143ce28e2",
            "value": "018056655d1c0570d043z800417z57z62z3ffz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369724",
            "to_ids": true,
            "type": "filename",
            "uuid": "6e7ab939-feae-4fdf-96bb-fec979ca37b1",
            "value": "astx_setup.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369724",
            "to_ids": false,
            "type": "text",
            "uuid": "992cef8c-2b8d-43bb-ad5f-d86adf7a5638",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:0/69\nFirst Submission:2025-12-09T06:11:17.000000+00:00\nLast Submission:2026-05-24T04:18:57.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374788",
        "uuid": "978e72dc-100e-4186-8f88-c10caaaf67af",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374788",
            "to_ids": true,
            "type": "md5",
            "uuid": "8511ee12-207b-4e00-b3a4-d21bdd817d05",
            "value": "39e091e981d9daab56e680927508bd1f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370758",
            "to_ids": true,
            "type": "sha1",
            "uuid": "491d72ba-68fa-4809-87aa-a800f6770caf",
            "value": "81b1537f604d5785e04100a76d32417484219028",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370758",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a6562b4c-4079-4d98-9770-152c038f8150",
            "value": "a762d65c0d6f6345541485aeef35a3b331b1f69bace8452cf55026b301e963bd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369873",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "91978260-5e3c-4e2c-af8c-af526e4b46f0",
            "value": "6144:Ov0hrcqAzxPD6no8t6CJrx2GXkGIczPNp9+mdzWaTwl9afIcoAW8q:Ov0hrcq0bD8ZJ9FIczPN+aqaTwl9yP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369873",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "235c088b-d702-412f-bbe1-65c25511bdbe",
            "value": "420864"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369873",
            "to_ids": true,
            "type": "vhash",
            "uuid": "0a4bcb8b-60e9-4d01-b506-1126ee11fe2d",
            "value": "145076655d555515155018z5cnz11z2az1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369873",
            "to_ids": true,
            "type": "filename",
            "uuid": "9a937309-330e-41ef-9d46-98b482f571f6",
            "value": "ufpizqgv.dat"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369873",
            "to_ids": false,
            "type": "text",
            "uuid": "748a7d6a-c044-42c7-b72f-e30a2a50c4b1",
            "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:47/71\nFirst Submission:2026-03-05T17:31:29.000000+00:00\nLast Submission:2026-03-05T17:31:29.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780374809",
        "uuid": "95d89492-4439-469b-b637-b1c49a361700",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780374809",
            "to_ids": true,
            "type": "md5",
            "uuid": "ee60c1ca-4d2d-4eb0-a539-11250c0c3c45",
            "value": "02897faac6e41781152f480565e5d572",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370760",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e9b1159d-47c9-4660-bc2c-a3c7b4d5826c",
            "value": "c42e0c055acc158446c1a7f53e1e8f3b49f73166",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370760",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a1166bdb-14af-409e-a1f8-450d76dc0388",
            "value": "97b0a7dc0aa99666ac8ce9d199acbb4cddc1e96c25213ff720f132d6066d3005",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780370022",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "be33c10c-6e53-461d-823f-30935149e72c",
            "value": "192:FTWsZw1avHU66GpK18IcwXjb+phmVpVD2xlEcrJBx9yDi8ok:p0ZEsAlEw1cDiw"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780370022",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9b640f44-928e-48e2-b1e0-eec8fc906dd2",
            "value": "12701"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780370022",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a862744e-054f-4cfb-af79-02e988ed2148",
            "value": "74315c08f9540011b9b65dbd39c2e7f6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780370022",
            "to_ids": true,
            "type": "filename",
            "uuid": "eeb522f8-db61-4c28-a936-ef656380179f",
            "value": "recaptcha.html"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  02/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780370022",
            "to_ids": false,
            "type": "text",
            "uuid": "71f711ce-919c-4427-923d-200d01a35f9b",
            "value": "Type Description: HTML\nMicrosoft: None\nVT Total Detection:3/61\nFirst Submission:2025-11-14T17:02:24.000000+00:00\nLast Submission:2025-11-14T17:02:24.000000+00:00"
          }
        ]
      }
    ]
  }
}