{
  "Event": {
    "analysis": "1",
    "date": "2026-05-19",
    "extends_uuid": "",
    "info": "[Threat Intel] Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia",
    "protected": false,
    "publish_timestamp": "1780284523",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780284523",
    "uuid": "88e3ed61-0d4d-462b-9c4c-2298d7d7b9c3",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Group-IB\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#f9cdc4",
        "local": false,
        "name": "misp-galaxy:target-information=\"Indonesia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Peru\"",
        "relationship_type": ""
      },
      {
        "colour": "#fa487c",
        "local": false,
        "name": "misp-galaxy:target-information=\"Philippines\"",
        "relationship_type": ""
      },
      {
        "colour": "#35a578",
        "local": false,
        "name": "misp-galaxy:target-information=\"South Africa\"",
        "relationship_type": ""
      },
      {
        "colour": "#33360c",
        "local": false,
        "name": "misp-galaxy:target-information=\"Thailand\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Gigabud\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Bank\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Finance\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"GoldDigger\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Remo\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1414\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1646\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Foreground Persistence - T1541\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1417.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Input Injection - T1516\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1417.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1660\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1426\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1437.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1626\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1417\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1418\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1422\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"GoldFactory\"",
        "relationship_type": ""
      },
      {
        "colour": "#5f0077",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"AndroidOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#170059",
        "local": false,
        "name": "rectifyq:topic=\"mobile-attack\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418847",
        "to_ids": false,
        "type": "link",
        "uuid": "acc0b26f-56df-4eb3-a28f-262197474fe9",
        "value": "https://www.group-ib.com/blog/indonesia-tax-impersonation-goldfactory-malware/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418847",
        "to_ids": false,
        "type": "text",
        "uuid": "ab2b36ed-cca3-4ff4-a95b-17e3b8bc8841",
        "value": "A sophisticated fraud campaign exploiting Indonesia's tax season targeted 67 million residents through fake Coretax applications distributed via phishing websites and WhatsApp social engineering. The GoldFactory threat cluster orchestrated operations using Gigabud.RAT and MMRat malware families with shared infrastructure abusing over 16 trusted brands across government and financial sectors. The attack chain combines vishing, screen recording, and remote access capabilities to achieve device compromise and unauthorized financial transfers. Estimated financial impact reaches USD 1.5-2 million nationwide, with global implications extending to USD 6 million annually across multiple countries. The industrialized malware-as-a-service infrastructure enables horizontal scaling across Thailand, Vietnam, Philippines, and South Africa, demonstrating a shift toward unified cross-border operations that systematically undermine trust in digital government services."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418847",
        "to_ids": false,
        "type": "text",
        "uuid": "fa01292e-6599-4b08-b334-a5e9f61459fd",
        "value": "Name: Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia\nAuthor: AlienVault\nAdversary: GoldFactory\nTags: [\"GoldFactory\", \"Gigabud.RAT\", \"MMRat\", \"Taotie\", \"Indonesia\", \"banking trojan\", \"phishing\", \"vishing\", \"MaaS\", \"brand abuse\"]\nTgtd countries: [\"Indonesia\", \"Peru\", \"Philippines\", \"South Africa\", \"Thailand\"]\nMlwr families: [\"Gigabud.RAT\", \"MMRat\", \"Taotie\"]\nAttack_ids: []\nIndustries: [\"Government\", \"Finance\", \"Energy\", \"Transportation\", \"Healthcare\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418847",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "e9a50743-8bba-462f-89a7-46b484cc714d",
        "value": "GoldFactory"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198077",
        "to_ids": true,
        "type": "domain",
        "uuid": "0933f5e5-870b-4100-a87d-de19076b9cf3",
        "value": "sso-tha.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197827",
        "to_ids": true,
        "type": "sha1",
        "uuid": "4c92d3a7-1f9f-450a-8a03-ba5385fd21a9",
        "value": "004d80e0efe9ea4d572350e8ce4771dfa432f0a2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197827",
        "to_ids": true,
        "type": "sha1",
        "uuid": "685550ae-8c61-4e09-94fd-25d324e14ac2",
        "value": "00fcb2abd35049ad3cc9a8a3e1aaba156c0770cf",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197829",
        "to_ids": true,
        "type": "sha1",
        "uuid": "f70a475c-7511-4c82-ad87-41a5282384eb",
        "value": "02462bace6937e92f3d1ef35f08c4ad270082104",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197830",
        "to_ids": true,
        "type": "sha1",
        "uuid": "182216b6-fccd-4f4f-b1c3-be3e72b4eec8",
        "value": "036aa79692470ad8d6a3bedb5da310af111317af",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197831",
        "to_ids": true,
        "type": "sha1",
        "uuid": "9a24525a-20de-4342-88d3-20c8eda19196",
        "value": "03a1bcd3ba59c02ce6c37699baa73a2c075a6644",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197832",
        "to_ids": true,
        "type": "sha1",
        "uuid": "93611f6a-5ed9-49fa-8c8f-32edebe1b714",
        "value": "041dcd27e1c77548f7d5897b43a6e1817cb3e9d0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197832",
        "to_ids": true,
        "type": "sha1",
        "uuid": "bf4bc820-fe50-4d57-8926-8339e57df86e",
        "value": "045144bfd86e0cf8d884ec4668d074a8d6eb4ee1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197833",
        "to_ids": true,
        "type": "sha1",
        "uuid": "e07d1601-068d-40f5-bcf1-4ccaed59fb4b",
        "value": "047190859b100d017c3b651f488eef8eba98ad28",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197834",
        "to_ids": true,
        "type": "sha1",
        "uuid": "cfb5236c-f770-4fa4-be11-901d68120a35",
        "value": "07701239a7003699a02aa97bfab46e7b92800949",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197835",
        "to_ids": true,
        "type": "sha1",
        "uuid": "f8943d04-8e65-4cd1-b49b-a57f42253e7b",
        "value": "0852fbee4372c194f429b8ec217a5699f56448dc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197837",
        "to_ids": true,
        "type": "sha1",
        "uuid": "43e41b5b-9a0b-4083-b4c7-945b4ae71767",
        "value": "3f018345d993d0d8fd778c7f6f4667cc0e974dd4",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197838",
        "to_ids": true,
        "type": "sha1",
        "uuid": "8c4253b8-c927-4b30-b9aa-9e1100575a84",
        "value": "6f474c2d89850f907f538921fd25bd52f0f99af0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197839",
        "to_ids": true,
        "type": "sha1",
        "uuid": "68dbfe96-6611-4ead-8fb5-bdb0cfe7617c",
        "value": "b125aea155d1d14be40644ba50f31418c3f40ebc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197840",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5a9c5daa-6e3f-4542-a6fa-934bf83d0d45",
        "value": "075d8eeb5552da8524eb14a6ed72416e6e956aa3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197841",
        "to_ids": true,
        "type": "sha1",
        "uuid": "8554027c-c228-4791-8042-eee982f618f3",
        "value": "3106aa0c8b260e36ece48b8a681353de76d69ca9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197842",
        "to_ids": true,
        "type": "sha1",
        "uuid": "c092c4d1-101d-4498-9588-cfe598ed9b8a",
        "value": "4911144aea43d00f6c7150766e4c0ab29c93d06e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197843",
        "to_ids": true,
        "type": "sha1",
        "uuid": "940725ba-2964-4bc7-b6fc-84345e221d97",
        "value": "9aab26a308f86ca137e6d6c171568a442e38abb6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197844",
        "to_ids": true,
        "type": "sha1",
        "uuid": "ba0278ea-9b91-4189-b7b8-71309aefe011",
        "value": "c74dbe25d81bbe3c5e6177049ee393f6657fb799",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197844",
        "to_ids": true,
        "type": "sha1",
        "uuid": "bdd1cf55-59d3-44e3-b951-f556eb5fdb52",
        "value": "cf9b8f3f1f795c3bdf0c14af66904ce8e2b95fff",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197845",
        "to_ids": true,
        "type": "sha1",
        "uuid": "694f7d19-a15c-43fd-a832-720ba2634ff0",
        "value": "f6627863f81cac5bf01664232473da47146f9d4c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198098",
        "to_ids": true,
        "type": "domain",
        "uuid": "eba3086c-9fba-480a-be29-881f3cf4f1d8",
        "value": "coretax-pajak.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198119",
        "to_ids": true,
        "type": "domain",
        "uuid": "28f26102-82b6-46dc-ad5a-7a76d7b1c05f",
        "value": "coretax-pajakonline.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198141",
        "to_ids": true,
        "type": "domain",
        "uuid": "68644065-acbf-4fea-b1b2-93aab8ddb085",
        "value": "coretax-peralihan.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198162",
        "to_ids": true,
        "type": "domain",
        "uuid": "8dd04268-7b3c-4c77-a80d-4e6893184e7e",
        "value": "coretax-registrasi.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198184",
        "to_ids": true,
        "type": "domain",
        "uuid": "a493bf08-e48e-4a4f-8a5a-418f9fd717b9",
        "value": "coretax-sinkronisasi.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198205",
        "to_ids": true,
        "type": "domain",
        "uuid": "231f9298-d80d-4464-9c34-c998d0f4dce2",
        "value": "coretaxlayanan.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198226",
        "to_ids": true,
        "type": "domain",
        "uuid": "996dd931-468c-4967-ba97-1a1b93ad334c",
        "value": "coretaxonline-pajak.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198247",
        "to_ids": true,
        "type": "domain",
        "uuid": "8525c28f-a5d4-433a-a64f-8cd249106c10",
        "value": "coretaxpelayan.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198268",
        "to_ids": true,
        "type": "domain",
        "uuid": "670db82b-6ffa-4cb3-9d12-ae6594a0c08b",
        "value": "coretaxpelayananonline.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198290",
        "to_ids": true,
        "type": "domain",
        "uuid": "cf9e27dc-3834-4594-8c0e-f37bd799e369",
        "value": "coretaxperalihan.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198311",
        "to_ids": true,
        "type": "domain",
        "uuid": "2772fb88-eb74-426f-a19d-5e0c9f1cff6d",
        "value": "newsss.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198333",
        "to_ids": true,
        "type": "domain",
        "uuid": "ac5db0f6-8c77-418e-bbb3-aa99d5cb6357",
        "value": "newsss.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198354",
        "to_ids": true,
        "type": "domain",
        "uuid": "cab398ca-f88e-41c5-9b31-96c1fc13bfd9",
        "value": "ngovsss.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198375",
        "to_ids": true,
        "type": "domain",
        "uuid": "809c245c-0167-41d5-9977-38bdcda652f6",
        "value": "onlinecoretaxpelayanan.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198401",
        "to_ids": true,
        "type": "domain",
        "uuid": "474da381-72ed-49f4-872a-7bf1a77c2345",
        "value": "pajakcoretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198422",
        "to_ids": true,
        "type": "domain",
        "uuid": "3596ca37-8d54-4bfe-8873-1965db363f15",
        "value": "pelayanan-coretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198443",
        "to_ids": true,
        "type": "domain",
        "uuid": "f9bc20ed-9d53-49f5-9012-3970021e1cbf",
        "value": "pelayananonlinecoretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198464",
        "to_ids": true,
        "type": "domain",
        "uuid": "dcec9bfe-a7f9-4931-b1b4-2cc2839f28f6",
        "value": "pelayananonlinepajak.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198485",
        "to_ids": true,
        "type": "domain",
        "uuid": "f5c77dd6-7e7c-4bbc-9a9e-8d28dc955ec5",
        "value": "pembaharuan-coretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198506",
        "to_ids": true,
        "type": "domain",
        "uuid": "4f780808-a1b8-4c14-b989-75b9af15e9d0",
        "value": "peralihan-coretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198528",
        "to_ids": true,
        "type": "domain",
        "uuid": "d504fb6f-98ca-4960-8b24-652e9ca4a67e",
        "value": "peralihancoretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198549",
        "to_ids": true,
        "type": "domain",
        "uuid": "64d61606-4c76-4b9b-a17f-141242126b4d",
        "value": "registrasi-coretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198570",
        "to_ids": true,
        "type": "domain",
        "uuid": "bb82a119-efc3-43de-812e-3cbab426bc4e",
        "value": "sinkronisasicoretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198591",
        "to_ids": true,
        "type": "domain",
        "uuid": "2590041d-e09f-4c57-a902-e664abd75ee0",
        "value": "sss-cgov.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198612",
        "to_ids": true,
        "type": "domain",
        "uuid": "c87164d1-c2ef-45a5-9f9f-bdab39f3bd6b",
        "value": "sss-gov.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198633",
        "to_ids": true,
        "type": "domain",
        "uuid": "5f9ab2ca-1394-40eb-b891-4cca2e749826",
        "value": "sss-negov.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198654",
        "to_ids": true,
        "type": "domain",
        "uuid": "032c9f15-fdcc-4057-9960-72187c8dfe7a",
        "value": "sssnegov.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198675",
        "to_ids": true,
        "type": "domain",
        "uuid": "206fee66-94c8-4347-adf9-7500c155de05",
        "value": "verifikasi-coretax.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198697",
        "to_ids": true,
        "type": "domain",
        "uuid": "6707b56f-370f-4465-b1c3-5981ec6eb924",
        "value": "verifikasicoretax.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198718",
        "to_ids": true,
        "type": "domain",
        "uuid": "452df6c2-9854-498c-99f5-38eca5381bef",
        "value": "verifikasicoretaxonline.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198739",
        "to_ids": true,
        "type": "hostname",
        "uuid": "38397f25-b8a6-486e-bf30-ba8dae544865",
        "value": "coretax.skjgo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198762",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f9d38d80-8e4a-4691-8bfa-c969a09aa3d9",
        "value": "coretax.svzgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198783",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e2432da4-dea7-46e5-b3c1-d7bdb1b94d27",
        "value": "coretax.vfbgo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198804",
        "to_ids": true,
        "type": "hostname",
        "uuid": "82a5a8a8-49f7-4492-b961-9d6e2f45973c",
        "value": "djp.otuind.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198825",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f12e5361-357f-47a2-a330-a318cc25f620",
        "value": "pajak.abbgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198846",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d90d6594-bdc2-48ca-a41a-2907e590281f",
        "value": "pajak.abfigo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198867",
        "to_ids": true,
        "type": "hostname",
        "uuid": "fe46819e-f920-4596-934e-9543eae8a74a",
        "value": "pajak.crxind.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198889",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0336e147-2156-4e86-b113-12053836d5c8",
        "value": "pajak.dkhid.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198910",
        "to_ids": true,
        "type": "hostname",
        "uuid": "93af16f9-beaa-41d0-a0e8-166c3f61e10b",
        "value": "pajak.jvcid.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198931",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2013bfe4-a574-4e8c-835b-a9e7ea249683",
        "value": "pajak.ksjvgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198952",
        "to_ids": true,
        "type": "hostname",
        "uuid": "119b4f51-9809-4c3a-9c29-9cbcb842d3db",
        "value": "pajak.mghgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198973",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d3c5ab57-41c7-42e8-b543-71dd3d1e43ca",
        "value": "pajak.mvzgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780198995",
        "to_ids": true,
        "type": "hostname",
        "uuid": "cfcb3c15-7577-4153-b753-c006df387ee0",
        "value": "pajak.mzfgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199016",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f1f44844-f509-4130-86fe-c045a7bfdb4f",
        "value": "pajak.nbvgo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199037",
        "to_ids": true,
        "type": "hostname",
        "uuid": "412cea1d-a9e3-4801-967b-69278e6f396c",
        "value": "pajak.nsbid.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199058",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1e30eb74-e235-4b96-8c74-07f87a39a533",
        "value": "pajak.oeixgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199079",
        "to_ids": true,
        "type": "hostname",
        "uuid": "467b21f5-7739-4bdd-9895-4bf47b966da3",
        "value": "pajak.wpiego.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199100",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6d9b2695-9723-469b-890f-df9625913aa3",
        "value": "pajak.yhvgo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199121",
        "to_ids": true,
        "type": "hostname",
        "uuid": "456eb6a6-bf19-490f-b360-58c886d21dc5",
        "value": "sss.aqego.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199142",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5b731c3d-5a42-4dbd-9fa9-73259c1990dd",
        "value": "sss.sksgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199163",
        "to_ids": true,
        "type": "hostname",
        "uuid": "025a5c59-688e-48ae-b561-0d9f5e4afe88",
        "value": "sss.slhgo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199184",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a77711d5-b3bc-4372-b5e3-4352bf6a45eb",
        "value": "sss.sligo.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199205",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b7c85d76-484e-4ae2-998d-c0987bef075e",
        "value": "137.220.194.7",
        "Tag": [
          {
            "colour": "#dd0399",
            "local": false,
            "name": "asn:asn=\"152194\"",
            "relationship_type": ""
          },
          {
            "colour": "#8c0628",
            "local": false,
            "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199227",
        "to_ids": true,
        "type": "domain",
        "uuid": "4a0f2b34-4752-4d5f-9c53-d67332acec15",
        "value": "sso-tha.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199248",
        "to_ids": true,
        "type": "hostname",
        "uuid": "25a0fece-f0cc-40b1-a024-6f5bc472435f",
        "value": "djp.dvhid.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199269",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6a92be91-facd-4e84-b902-655099abc4f7",
        "value": "taspen.xufgo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780177179",
        "to_ids": false,
        "type": "malware-type",
        "uuid": "ff93c300-f21d-4612-836e-4be5841f5552",
        "value": "Gigabud.RAT",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1414\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1646\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Foreground Persistence - T1541\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1417.002\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Input Injection - T1516\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1417.001\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1660\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1426\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1437.001\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"GoldFactory\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780177170",
        "to_ids": false,
        "type": "malware-type",
        "uuid": "707415c9-0c76-4969-85f8-5f5b7360f2da",
        "value": "MMRat",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1626\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1646\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Foreground Persistence - T1541\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1417\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Input Injection - T1516\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1660\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1418\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1426\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1422\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1437.001\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"GoldFactory\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199290",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3901e94a-77af-46f1-a7e4-9d2b4c5deefa",
        "value": "172.67.175.60",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199311",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "84930a99-fa7e-4188-9fef-bdc770b2bfa7",
        "value": "172.67.221.239",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199333",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1e12afb3-6123-4e0d-895c-7dd0f3bc683e",
        "value": "104.21.31.66",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199354",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5a56363f-f115-4a2e-94d3-436444622d3a",
        "value": "172.67.172.152",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199375",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c5028a46-a50e-4a49-845b-eb427b2a03a5",
        "value": "172.67.171.82",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199396",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1400e465-9001-41c0-b1cf-4a744a858074",
        "value": "172.67.221.248",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199417",
        "uuid": "6e272862-a752-481e-af6f-5dd2dd9eb626",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199417",
            "to_ids": true,
            "type": "md5",
            "uuid": "60e5f424-c8cd-47ae-981e-d8ef9df215e9",
            "value": "6f24669eb20d9a182bb5a7438636aecc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197817",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0faee90a-a803-4463-8575-e06109958196",
            "value": "49acba8d46b57fdd324f32735e0052750f51b844",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197817",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d1a0eccb-00d2-42a9-ada9-ab958f029ebc",
            "value": "5c11e77e402a37e80785dee5d657273007c8321fb79c160d04546f655285ed5b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197035",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "85f9a832-0319-4869-9177-b75a048efdec",
            "value": "196608:U0tJgiEkO8bDrcmD8qP/FZkMjmdgaho+EEKqColBOvr1:U0vDEkOE8mDvHFZkEmdgslrBo"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197035",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "531d2a48-228d-4608-8c8b-591b48e03560",
            "value": "11189420"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197035",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7c3741a5-7165-4ff0-b257-5cf57b35d855",
            "value": "2133516baddd33a3b0b2bd07c5fab4cd"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197035",
            "to_ids": true,
            "type": "filename",
            "uuid": "1fcd0cff-0c2a-4112-915b-562ba5e124b9",
            "value": "idnn.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  16/03/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197035",
            "to_ids": false,
            "type": "text",
            "uuid": "d4c2bd6e-9119-415c-874f-4e3f8894c6f9",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:22/69\nFirst Submission:2025-06-04T05:50:17.000000+00:00\nLast Submission:2025-06-04T05:50:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199439",
        "uuid": "13a5855e-346d-4459-88fa-2c29b8f5ebe8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199439",
            "to_ids": true,
            "type": "md5",
            "uuid": "801c7cf2-2e6d-432d-8334-850fa746e646",
            "value": "82d696d2e430ec98f6ee371b6e5c3e86",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197818",
            "to_ids": true,
            "type": "sha1",
            "uuid": "315679ee-ec28-42c1-bb53-79ad56f7e166",
            "value": "7b5c154e4aaa51b3652dc685c2f21b6eb70c1440",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197818",
            "to_ids": true,
            "type": "sha256",
            "uuid": "287a83e0-e70b-4731-addc-68d9c0ae54ad",
            "value": "ce8c4da7287a2619a0ae3267484ea4f4a19f7d301245404828ada1c5fb926f5e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197081",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ec45eacc-db7b-49e0-9cf8-6e3c1e5e33bf",
            "value": "196608:UuAccIB4l6cp9WYZdz+lH1dbzMm05PXTx8DVGr/AwYBUgaho+EEKqColBOvlF:UubVYrz+p1Fz+5/W4zAwY6gslrBq"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197081",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "64e66569-de2c-42b1-82bb-ed71af5d722e",
            "value": "11197612"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197081",
            "to_ids": true,
            "type": "vhash",
            "uuid": "df5aac49-ae9c-4c91-93cf-93f256d0941a",
            "value": "2133516baddd33a3b0b2bd07c5fab4cd"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197081",
            "to_ids": true,
            "type": "filename",
            "uuid": "5c0c455e-75ea-4778-a4c3-a78dd5441199",
            "value": "coretax-9-16.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197081",
            "to_ids": false,
            "type": "text",
            "uuid": "2560ff3a-8bb6-444f-a727-0f6489e13db9",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:29/68\nFirst Submission:2025-09-24T16:04:18.000000+00:00\nLast Submission:2025-09-24T16:04:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199460",
        "uuid": "62616c1f-3141-4bbc-af3b-e9f578ceeda7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199460",
            "to_ids": true,
            "type": "md5",
            "uuid": "6359f137-1849-43dc-aba4-f0fca677f6d2",
            "value": "0111bc7f6671900bbd4e53aa757a5672",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197820",
            "to_ids": true,
            "type": "sha1",
            "uuid": "516124ff-70f6-4f7c-8fe5-305513482543",
            "value": "ea87642a88788469e7aafc4657588b39709f1509",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197820",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9354bbfa-0b7d-41dc-8a2e-c9dfb427b1b1",
            "value": "047fba84af096c262ac5fdf4d6a6513a018ec869d717f51c9ddc85be160abe31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197124",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a219deba-5737-4995-a230-be9938f17efc",
            "value": "196608:s4CNTmXP/SDuolD4wmYnrObQ0rQhg+MuZSZ5kGgaho+EEKqColBOvRb:INT1WwmYn4dp2egslrBE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197124",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "79821426-5d64-45da-91ac-c13c8e560eca",
            "value": "11193516"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197124",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c829c453-dc4b-4631-8521-ae9a2952c2eb",
            "value": "2133516baddd33a3b0b2bd07c5fab4cd"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197124",
            "to_ids": true,
            "type": "filename",
            "uuid": "9fc82f53-d422-419f-8cdf-cffe306c5105",
            "value": "sgid-coretax-8-1.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  10/03/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197124",
            "to_ids": false,
            "type": "text",
            "uuid": "d3ad6a38-ed1f-4c1f-b932-4068fe47ad37",
            "value": "Type Description: Android\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:22/68\nFirst Submission:2025-08-07T11:38:01.000000+00:00\nLast Submission:2025-09-13T05:41:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199482",
        "uuid": "9f2c1526-5d30-401a-8524-8de81242e678",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199482",
            "to_ids": true,
            "type": "md5",
            "uuid": "5ced43e5-b736-4004-ab71-d4e785b9563a",
            "value": "a70dfc48b59aaa5099577c3719b576ce",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197821",
            "to_ids": true,
            "type": "sha1",
            "uuid": "aad64d66-d761-4b64-b877-13a11a5e95fa",
            "value": "2a954c7c1d764493abc285c34e47525c211fe768",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197821",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0f0f32b5-d8a5-4e03-8358-f1097027f664",
            "value": "b0f45091e7290797be2a85032d797891064a5cd611b194534b78cb024003468d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197167",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2935633f-afd6-4294-bf04-932297cc55da",
            "value": "393216:IXyzcqxrJbe1tv13uFnCPwtg44gYn7JlfD5BCs3FNgIuWt3upJwwedtv13uFnCPb:ItqRAnPCsFitRbhjnDQA8TgQf"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197167",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "766e57aa-f62d-4d05-ba30-7f766dbb067e",
            "value": "31189981"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197167",
            "to_ids": true,
            "type": "vhash",
            "uuid": "719e50f2-6757-4c05-858e-ea1a1a9ca8ce",
            "value": "37c33af1521905cd4019832cdf7c1b71"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197167",
            "to_ids": true,
            "type": "filename",
            "uuid": "2e72c59f-24f6-49ce-96f7-d8fbb9e3d864",
            "value": "coretax_1_7_8_20251229.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  06/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197167",
            "to_ids": false,
            "type": "text",
            "uuid": "e491fc02-3559-432f-bbdd-f628cd447278",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:9/65\nFirst Submission:2026-01-01T07:22:47.000000+00:00\nLast Submission:2026-01-15T08:24:43.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199503",
        "uuid": "dc351650-7c64-4d95-b455-92e3e26dc809",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199503",
            "to_ids": true,
            "type": "md5",
            "uuid": "dfb7a53e-1246-4bcb-ab32-82eec7322fe8",
            "value": "22287ce8e36a7860aa7368ab5ffe85ff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197822",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8218f835-aa64-48ad-ba7c-0830939e0126",
            "value": "3bb475b9de75a5f1c6a941210b88b0c0f55f7005",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197822",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4bd39600-03d3-40ab-ba67-61b889a4c313",
            "value": "656f45ac15f0a703a2b9b6ad98886bab0bba1d6ba176a5836d6a247136eb6c52",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197214",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5a43a94b-94db-4df9-b93f-7b84edf55b4e",
            "value": "393216:ivczYGe1tv13uFnCPwtg44gYn7JlfD5BCs3FNgIuWt3upJwwedtv13uFnCPwc0eK:iUzonPCsFitRbhjnKQA8TgQT"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197214",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e7715603-99fa-417d-9e98-e6868d13bd95",
            "value": "31206945"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197214",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ef44695e-3339-4d04-8a7b-15993592948e",
            "value": "37c33af1521905cd4019832cdf7c1b71"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197214",
            "to_ids": true,
            "type": "filename",
            "uuid": "5e9d3b8e-b11d-4f48-9c53-e67a1a707d54",
            "value": "coretax_1_8_2_20260115.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  16/04/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197214",
            "to_ids": false,
            "type": "text",
            "uuid": "112ad892-c9fc-4b51-b9ea-01a1eff7127c",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:6/67\nFirst Submission:2026-01-18T10:46:09.000000+00:00\nLast Submission:2026-01-28T07:56:32.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199525",
        "uuid": "737991e6-13e5-4fc4-a313-7f5c53b7cc3b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199525",
            "to_ids": true,
            "type": "md5",
            "uuid": "cfcaf5cd-7c0f-4eba-acf8-63ed51e8394e",
            "value": "59be73a679ac8f661cf9a686e8095177",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197824",
            "to_ids": true,
            "type": "sha1",
            "uuid": "cf155b29-a6f5-4ad5-bee2-5fdf6d5522b8",
            "value": "4bb5c9382fe37012017c88c6ac90afa2efeb2cbc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197824",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e47beffc-7e7a-4791-8d58-436d1f89ef75",
            "value": "5513348df877471f81188210d2e8f2ba1c11ae087692c4ff6f64639a928c6b3d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197260",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "75f237e9-ea79-4575-b48e-ca9e880cfbe2",
            "value": "393216:VTpP6Xgte1tv13uFnCPwtg44gYn7JlfD5BCs3FNgIuWt3upJwwedtv13uFnCPwc/:VTpP6nnPCsFitRbhjnZQCZTKQo"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197260",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e61514e8-885c-42ab-bc85-235e777787c0",
            "value": "30963974"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197260",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2ee2638c-148a-41e1-afbf-6942b8805193",
            "value": "37c33af1521905cd4019832cdf7c1b71"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197260",
            "to_ids": true,
            "type": "filename",
            "uuid": "d7aeea0b-6294-499c-9480-bb39984c86a5",
            "value": "coretax_1_7_5_20251220.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  29/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197260",
            "to_ids": false,
            "type": "text",
            "uuid": "afad83c0-0506-4168-b41f-0854b8f8ca21",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:9/67\nFirst Submission:2025-12-29T04:28:02.000000+00:00\nLast Submission:2025-12-30T06:44:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199546",
        "uuid": "57922dbe-2012-4f33-8a77-053ab3205ccb",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199546",
            "to_ids": true,
            "type": "md5",
            "uuid": "bc9b8ace-3426-4b1c-ad2f-f21d9eea2f57",
            "value": "94c1c1628adbbf4a3fd62f8f4441f185",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197825",
            "to_ids": true,
            "type": "sha1",
            "uuid": "48ae1573-e0f0-42bd-af58-f82e59434eca",
            "value": "fd09c9c916436e13da1c204f1f4c276c159f198a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197825",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f20502b5-42f1-4618-abe0-d9824eb522b0",
            "value": "78710ef01be7bf414faa7f45b2b2c03406ba5dcd661bd2978e3084cf2991415e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197367",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b3bc4f51-4a85-46c7-9a0c-5b57d30f9b3e",
            "value": "393216:afDYrmwS4je1tv13uFnCPwtg44gYn7JlfD5BCs3FNgIuWt3upJwwedtv13uFnCPI:aDqmwDmnPCsFitRbhjn7QSYOGQZ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197367",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ea8a505f-7285-4652-8a16-390dc83b716d",
            "value": "30941964"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197367",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5875b4b9-446b-4980-8336-0ac1fbe41082",
            "value": "37c33af1521905cd4019832cdf7c1b71"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197367",
            "to_ids": true,
            "type": "filename",
            "uuid": "b737ef4c-95ba-460d-b345-7414d0525ce9",
            "value": "coretax_1_0_69_20251029.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  31/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197367",
            "to_ids": false,
            "type": "text",
            "uuid": "e816f081-2fbd-402e-a8db-edaaa7099e1b",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:11/67\nFirst Submission:2025-11-04T03:33:56.000000+00:00\nLast Submission:2026-01-20T03:37:22.000000+00:00"
          }
        ]
      }
    ]
  }
}