{
  "Event": {
    "analysis": "1",
    "date": "2026-07-30",
    "extends_uuid": "",
    "info": "[Threat Intel] Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers",
    "protected": false,
    "publish_timestamp": "1785649728",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785649728",
    "uuid": "8c51e471-2454-4b79-8336-2e0a61f0d065",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7bf409",
        "local": false,
        "name": "misp-galaxy:producer=\"CloudSEK\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553209",
        "to_ids": false,
        "type": "link",
        "uuid": "4b679e85-3740-41ec-8f85-0742fe8c0b38",
        "value": "https://www.cloudsek.com/blog/tax-season-open-season-phishing-and-malware-campaigns-targeting-indian-taxpayers"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553209",
        "to_ids": false,
        "type": "text",
        "uuid": "ce9014ae-cec6-41ca-a664-708fad88cb76",
        "value": "A sophisticated malware campaign is targeting Indian taxpayers during filing season by impersonating the Income Tax Department. Attackers distribute fake penalty notices via WhatsApp from unknown or compromised accounts, using forged Office Memorandums citing legitimate tax law sections and creating 72-hour deadlines to induce panic. The campaign delivers ITD.zip files containing malicious Android APKs and Windows executables that harvest OTPs, banking credentials, and enable remote access. The infrastructure relies on disposable domains using cheap TLDs and Alibaba Cloud storage for payload delivery. This activity is part of a broader ecosystem including refund SMS fraud, cloned e-Filing portals, and fake e-PAN emails. The operation demonstrates resource and planning through bilingual content, payload rotation to evade detection, and abuse of legitimate code-signing certificates."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553209",
        "to_ids": false,
        "type": "text",
        "uuid": "82eeeef1-0908-484a-8b11-721e6374f694",
        "value": "Name: Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers\nAuthor: AlienVault\nAdversary: \nTags: [\"phishing\", \"india\", \"tax season\", \"banking credentials\", \"whatsapp delivery\", \"infostealer\", \"fake government notices\", \"otp theft\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\"]\nMlwr families: []\nAttack_ids: [\"T1056.001\", \"T1539\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1071\", \"T1555\", \"T1055\", \"T1016\", \"T1497\", \"T1573\", \"T1095\", \"T1012\", \"T1518.001\", \"T1027.002\", \"T1574.002\", \"T1105\", \"T1204.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785648947",
        "to_ids": true,
        "type": "domain",
        "uuid": "74f78088-1ec4-4f59-b5dc-97038cca0ba9",
        "value": "laoshunfa.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785648968",
        "to_ids": true,
        "type": "domain",
        "uuid": "3ef705d7-9419-40ac-83c7-9db3430f49fa",
        "value": "gov-xnui.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785648989",
        "to_ids": true,
        "type": "domain",
        "uuid": "7e626b8b-54a2-4e4c-a317-d02945a44455",
        "value": "gova.lat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649010",
        "to_ids": true,
        "type": "domain",
        "uuid": "7b8108a8-7077-40c9-9c5b-f95a73837b2d",
        "value": "indiaaba.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644360",
        "to_ids": true,
        "type": "md5",
        "uuid": "afd4bd19-4849-43b6-9f33-adea64d4928c",
        "value": "2d85a7a16d1eb86dfd92b00f6267733d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644381",
        "to_ids": true,
        "type": "md5",
        "uuid": "966a08b7-7ed6-4335-a82f-a73668d23e80",
        "value": "538ad8e0ad1fec0ecc54f9e120ac6ff9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649031",
        "to_ids": true,
        "type": "url",
        "uuid": "c30a1a47-33f5-4ad5-a39f-c5a943826a3f",
        "value": "http://gova.lat/1.html",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649052",
        "to_ids": true,
        "type": "url",
        "uuid": "a21c30a4-a860-43bc-b8fa-a9f6e9b6545f",
        "value": "http://govj.one/index.html",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649074",
        "to_ids": true,
        "type": "domain",
        "uuid": "0add3b84-0203-429a-8f61-c8409f21a788",
        "value": "apeal.lol",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649094",
        "to_ids": true,
        "type": "domain",
        "uuid": "a3d14c8a-e364-4c87-b2fe-cd3b4dba03bf",
        "value": "audet.club",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649115",
        "to_ids": true,
        "type": "domain",
        "uuid": "2605aa72-f2a5-4379-8c6c-9d440e58dc64",
        "value": "bcgovtop.lol",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649136",
        "to_ids": true,
        "type": "domain",
        "uuid": "50c1166d-80bd-4648-b9aa-b2ac4ed0ff23",
        "value": "ckoming.study",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649157",
        "to_ids": true,
        "type": "domain",
        "uuid": "61e03141-0bfd-4a99-948d-b8c295645724",
        "value": "clerk.lat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649178",
        "to_ids": true,
        "type": "domain",
        "uuid": "db112567-f999-403e-a255-17889beb806b",
        "value": "fsyahsxd.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649199",
        "to_ids": true,
        "type": "domain",
        "uuid": "68438254-3170-4da8-8bac-dd6e5f79498b",
        "value": "gisudyawz.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649221",
        "to_ids": true,
        "type": "domain",
        "uuid": "233a755e-0397-43f9-8cf9-54805a1dfd90",
        "value": "gova.bar",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649242",
        "to_ids": true,
        "type": "domain",
        "uuid": "b6fe6383-a8e3-4e01-b787-e1ed7e677054",
        "value": "govj.one",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649264",
        "to_ids": true,
        "type": "domain",
        "uuid": "ef22fd36-c0ac-45bb-bf87-420d63d55784",
        "value": "govtocki.shop",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649285",
        "to_ids": true,
        "type": "domain",
        "uuid": "2dec42a9-1f07-4faa-9e3f-5b2f2e1f12b5",
        "value": "ingovtop.click",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649307",
        "to_ids": true,
        "type": "domain",
        "uuid": "4b1f6d01-3b4b-4500-86fc-19731b604029",
        "value": "kcsueaw.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649328",
        "to_ids": true,
        "type": "domain",
        "uuid": "b08a1344-8aa6-4c9d-82b2-5ef4b9992174",
        "value": "konimqh.study",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649349",
        "to_ids": true,
        "type": "domain",
        "uuid": "df3e0659-7d9f-4a77-9319-c9352ccf30c9",
        "value": "laiuatexqw.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649370",
        "to_ids": true,
        "type": "domain",
        "uuid": "40369294-7937-4d71-bd3e-a6f8bc4e319c",
        "value": "lzaiwugsa.ink",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649391",
        "to_ids": true,
        "type": "domain",
        "uuid": "fa14b2d9-2a9a-4ef7-b8b6-9f94e62bc7de",
        "value": "oder.autos",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649412",
        "to_ids": true,
        "type": "domain",
        "uuid": "de00b382-2342-4bd9-8185-af3041c36e09",
        "value": "qaksdiuw.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649433",
        "to_ids": true,
        "type": "domain",
        "uuid": "029d34fa-10b0-4efc-a6d0-8612835d1842",
        "value": "sfinmgov.club",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649454",
        "to_ids": true,
        "type": "domain",
        "uuid": "6f70798d-9b81-40f7-bfa7-08cdfeb8edf7",
        "value": "tarif.lol",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649475",
        "to_ids": true,
        "type": "domain",
        "uuid": "96071541-d6c8-4709-83f6-98d8d2c91c81",
        "value": "tzawccsw.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649496",
        "to_ids": true,
        "type": "domain",
        "uuid": "e3dcefa3-4821-4c48-a7b5-22a89029cc81",
        "value": "xcvgyuraw.live",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649517",
        "to_ids": true,
        "type": "domain",
        "uuid": "b71b1cd8-423e-4ee1-b6a7-6d1b5a0310b8",
        "value": "zasudtytw.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649538",
        "to_ids": true,
        "type": "domain",
        "uuid": "8569fb8b-c412-4823-8b0e-387d5e114938",
        "value": "zixhasda.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649559",
        "to_ids": true,
        "type": "domain",
        "uuid": "dede66b8-52d9-49d2-bedb-edeeb5e22984",
        "value": "zuytyarws.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649581",
        "to_ids": true,
        "type": "domain",
        "uuid": "f3509f27-a46a-46b9-964d-30743ba17022",
        "value": "zxizusuy.xin",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649602",
        "to_ids": true,
        "type": "domain",
        "uuid": "98d950ca-3b71-45a8-a609-f2901384b2e3",
        "value": "zytsyxbwa.live",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649623",
        "to_ids": true,
        "type": "hostname",
        "uuid": "500b4e49-b335-4ef2-b689-9858348d1615",
        "value": "22.laoshunfa.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Alibaba Cloud OSS bucket (Hong Kong), 47.79.66.58. Abused to host the second stage.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649644",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ec34f04b-9eda-461f-a67a-6f4acd138731",
        "value": "47.79.66.58",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Follow-on binary fetched after execution.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649666",
        "to_ids": true,
        "type": "url",
        "uuid": "7ac29080-1c9b-4112-a459-179ac6639d1f",
        "value": "https://vss2.oss-cn-hongkong.aliyuncs.com/88.bin",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Alibaba Cloud OSS bucket (Hong Kong), 47.79.66.58. Abused to host the second stage.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785649687",
        "to_ids": true,
        "type": "domain",
        "uuid": "ae49706f-317a-4c99-b2d1-992990c28fff",
        "value": "vss2.oss-cn-hongkong.aliyuncs.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-07T10:04:07+00:00",
        "last_seen": "2026-07-07T10:04:07+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785649708",
        "uuid": "af814e05-0264-4c7b-b58d-822be58fbba5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "md5",
            "timestamp": "1785649708",
            "to_ids": true,
            "type": "md5",
            "uuid": "ac4ad21f-6756-4dee-b3a2-432656f66a2e",
            "value": "dff2b7a23882445b4e354199bf38554f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "sha1",
            "timestamp": "1785644382",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ad521822-7969-4b79-8ce1-43726c7b1e0d",
            "value": "7479fbc27320ae246db9030cca80809ec63de0e9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "sha256",
            "timestamp": "1785644383",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8049aa9d-ea79-45cd-a746-1c8ef80fb93e",
            "value": "667b37eafb9ec5131ed4f017ed429a47dca3adf626b2fc85fc6424b1e17ff6e1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "text",
            "timestamp": "1785644382",
            "to_ids": false,
            "type": "text",
            "uuid": "c5ee7d0e-c2f3-4712-ac9c-0e75fcbdbf64",
            "value": "Type Description: Win32 EXE\nOriginal name: svchost.exe\nVerified: Signed\nSigning date: 01:22 PM 07/01/2026\nSigners: \u6c82\u6c34\u53bf\u6781\u5ba2\u7f51\u7edc\u79d1\u6280\u670d\u52a1\u5de5\u4f5c\u5ba4\uff08\u4e2a\u4f53\u5de5\u5546\u6237\uff09; Certum Extended Validation Code Signing 2021 CA; Certum Trusted Network CA 2; Certum Trusted Network CA\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 27/75\nFirst Submission: 2026-07-07T10:04:07+00:00\nLast Submission: 2026-07-07T10:04:07+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "creation-time",
            "timestamp": "1785644382",
            "to_ids": false,
            "type": "datetime",
            "uuid": "64aa0d44-4d4e-41d4-b231-e96ba322c68b",
            "value": "2026-07-01T13:21:55+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785644382",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "61607a4c-02f7-4f4d-b958-aeb08c075f5f",
            "value": "49152:FljBvLy8jLwAWKuuzswql6MKn3HjFYfCpdIGF+Y5INE0pUlK1R1:FlxjcA7zsV6M2H6apTRYUwl"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785644382",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bcc7d3c6-de0e-4c04-8bdb-d9ee783dd35c",
            "value": "3265096"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "vhash",
            "timestamp": "1785644382",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7ab4a4f0-b7e2-4042-8c0f-29813718a0d7",
            "value": "03603e7d1d10101011z11z47z1015z13z13z1017z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-07T10:04:07+00:00",
            "last_seen": "2026-07-07T10:04:07+00:00",
            "object_relation": "filename",
            "timestamp": "1785644382",
            "to_ids": true,
            "type": "filename",
            "uuid": "7a22d659-72af-4e39-923e-e061aaa42279",
            "value": "svchost.exe"
          }
        ]
      }
    ]
  }
}