{
  "Event": {
    "analysis": "1",
    "date": "2026-06-19",
    "extends_uuid": "",
    "info": "[Threat Intel] Analysis of Gamaredon campaign targeting Ukraine weaponizing CVE-2025-8088",
    "protected": false,
    "publish_timestamp": "1782443592",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782443592",
    "uuid": "90601b9c-6e0a-4813-87cf-826d16672a8c",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f4b62b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8bde06",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"NTFS File Attributes - T1564.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e4d611",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ukraine\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866817",
        "to_ids": false,
        "type": "link",
        "uuid": "7581a595-e410-4f7b-83ba-bee25692e1e3",
        "value": "https://x.com/nextronresearch/status/2067508038542545203",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866817",
        "to_ids": false,
        "type": "text",
        "uuid": "98f80970-8d12-409b-a177-b7f8b727f024",
        "value": "A campaign exploiting the WinRAR path-traversal vulnerability CVE-2025-8088 has been actively targeting Ukraine since February 2026, with ongoing activity through June 2026. The operation uses Ukrainian military and conscription-themed documents as lures, distributed as RAR archives. The malicious archives contain NTFS alternate data streams with path-traversal sequences that automatically place LNK files into the Windows Startup folder upon extraction. These shortcuts execute hidden PowerShell stagers incorporating anti-analysis techniques including debugger checks, disk-space verification, and sleep delays to evade sandbox detection. The persistent nature of the attacks demonstrates continuous targeting of Ukrainian entities over a four-month period using social engineering focused on military documentation themes."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866817",
        "to_ids": false,
        "type": "text",
        "uuid": "621053dd-63d5-4767-8d34-b15abac319c1",
        "value": "Name: Analysis of Gamaredon campaign targeting Ukraine weaponizing CVE-2025-8088\nAuthor: AlienVault\nAdversary: Gamaredon\nTags: [\"path-traversal\", \"cve-2025-8088\", \"military-lures\", \"conscription-themed\", \"powershell\", \"gamaredon\", \"ukraine\", \"winrar\", \"persistence\"]\nTgtd countries: [\"Ukraine\"]\nMlwr families: []\nAttack_ids: [\"T1204.002\", \"T1497.001\", \"T1566.001\", \"T1497.003\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1071.001\", \"T1105\", \"T1564.004\"]\nIndustries: [\"Defense\", \"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354496",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "4c6b8d49-ef05-4c51-868e-0744503f477c",
        "value": "Gamaredon",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866817",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "a52f7542-1c64-432f-b8fd-7e1630a7466b",
        "value": "CVE-2025-8088"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442259",
        "uuid": "0608f9b4-de3d-4852-9c66-6e064d94c309",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442259",
            "to_ids": true,
            "type": "md5",
            "uuid": "3c86b2bc-38d6-4537-95f4-56afdf3fd474",
            "value": "473c65b922d3308a98c6b76c7d99a196",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367217",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d4e892ee-36e8-4820-8b5a-187782621e81",
            "value": "d8d789af0ede2ce38a50b516f7603376589ae141",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367217",
            "to_ids": true,
            "type": "sha256",
            "uuid": "37ea44d0-bf8c-4cca-bf5a-f828b1a410f4",
            "value": "2add9429d2822ae0c01c08bbd66c3a110ef2e9c3a00cded1477657e9024e391e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366594",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d1773928-dd28-47af-b675-1fe9c6365491",
            "value": "24576:YQ94THFClJLWjLK24pc9BBb5SpRuWH7UCjQN/O:RiHMlNgGu/WRTjQN/O"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366594",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "efea71b6-6ebf-4343-ab45-b75fe000a0c2",
            "value": "828496"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366594",
            "to_ids": true,
            "type": "filename",
            "uuid": "a1e9ec50-500f-4464-9bde-a098ca42a6bc",
            "value": "2add9429d2822ae0c01c08bbd66c3a110ef2e9c3a00cded1477657e9024e391e.rar"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  22/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366594",
            "to_ids": false,
            "type": "text",
            "uuid": "53df2145-e69b-42e4-b9ea-e1c9ac8e8756",
            "value": "Type Description: RAR\nMicrosoft: Trojan:Win32/Suschil!rfn\nVT Total Detection:31/63\nFirst Submission:2026-06-05T07:42:38.000000+00:00\nLast Submission:2026-06-05T11:01:00.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442280",
        "uuid": "80c169b5-879f-4475-b7d4-9e244ac30415",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442280",
            "to_ids": true,
            "type": "md5",
            "uuid": "2a7be209-481c-482e-8e85-17989f557333",
            "value": "a113090d748d0dac7d488c97f1305af2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367218",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f1f58fda-69f0-4bf7-a114-78e1ed414fed",
            "value": "1f34a8fad545554420650a8518d4199431fc2920",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367218",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0a400bce-127b-4ff4-b6df-9753394c6e75",
            "value": "cb65f5873c72d707371ec56fb8ba501a5c7f5940e9c5a2d28c9b379ce216900c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366616",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cc91897c-18e0-4f3c-839c-7b7505374c80",
            "value": "24576:vC4jFYJ4EklJLWjLK24pc9BBb5SpRuWH7UCjQN/O:qUFEolNgGu/WRTjQN/O"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366616",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "630f2dc7-6828-43bd-abe5-bb74bbc921d2",
            "value": "845661"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366616",
            "to_ids": true,
            "type": "filename",
            "uuid": "4b0ed937-0fc2-4276-aa59-b3de138374f6",
            "value": "cb65f5873c72d707371ec56fb8ba501a5c7f5940e9c5a2d28c9b379ce216900c.rar"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366616",
            "to_ids": false,
            "type": "text",
            "uuid": "cc5fee3a-b021-406a-b50b-9ced6285399a",
            "value": "Type Description: RAR\nMicrosoft: Trojan:Win32/Suschil!rfn\nVT Total Detection:31/63\nFirst Submission:2026-06-05T07:42:50.000000+00:00\nLast Submission:2026-06-05T11:01:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442301",
        "uuid": "d080d696-a99b-4d78-87a7-1e86459a96de",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442301",
            "to_ids": true,
            "type": "md5",
            "uuid": "a4b28409-5e67-446f-ab36-e600df196f47",
            "value": "587a464ffc174288d3f66d1845133229",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367219",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e56b5292-da14-45b9-b496-6f9275ab7327",
            "value": "23e076f5db64fb51226ef56a60bae6424b06a432",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367220",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a5f215ff-562f-4e04-a292-b55328848da2",
            "value": "1c170b7470d507378ddb78e9d66305f1184e965baaf2d27ededb23a318a58953",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366637",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c75aedf1-cb1a-438c-8f60-f69eb23b2c12",
            "value": "24:8+XQWJeEyZRrACe+/5+nX4aanzIq9nYg/izm:80+bHcq+X4ZzdY6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366637",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5be7356e-6783-442a-8aff-da620787caf3",
            "value": "1203"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366637",
            "to_ids": true,
            "type": "vhash",
            "uuid": "65e4d5f3-1a33-4017-bfa8-c5935ee0e50d",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366637",
            "to_ids": true,
            "type": "filename",
            "uuid": "58b22d0a-f819-4fae-8702-4d181a4c0fdb",
            "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260316-9055897-1.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_yXZ9BtFU2OewE.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366637",
            "to_ids": false,
            "type": "text",
            "uuid": "47c3b732-8c32-4e67-9070-6269ed3eab61",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:35/62\nFirst Submission:2026-03-17T05:49:39.000000+00:00\nLast Submission:2026-03-17T05:49:39.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442322",
        "uuid": "0ba79f4b-780b-4a8a-8ecb-21919012b414",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442322",
            "to_ids": true,
            "type": "md5",
            "uuid": "1b982fe9-9342-4f19-a0e8-079c8e907b5f",
            "value": "addf25d1f994729f2d3cbb3d0ab49897",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367221",
            "to_ids": true,
            "type": "sha1",
            "uuid": "816a8b85-601c-4346-8817-4ccad3d36680",
            "value": "ad102478adda75ef6c6985187fc1e8b0bc1edded",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367221",
            "to_ids": true,
            "type": "sha256",
            "uuid": "28e02661-8aaf-4979-a71c-85606acddccd",
            "value": "507b2fcdae058cebbd550965b90c44e878d7a2463058c846eeb68f0dc1b48eda",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366659",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "dba35a2a-3a96-4bf2-88d2-18c968c9d628",
            "value": "24:8VYQWJml1Ul9XACe+/5+d4khI2Hl8q9nYg/izm:8VYGl1fq44khI2H7Y6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366659",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6a154199-b416-4256-836e-51cd4b50104e",
            "value": "1207"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366659",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e438e2dc-0ed2-4276-bfc7-748ddfac9550",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366659",
            "to_ids": true,
            "type": "filename",
            "uuid": "9adeb441-6f21-4b7b-83b6-0a82a5147b48",
            "value": "2523_20535670.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_bfF3BxteabXqg.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366659",
            "to_ids": false,
            "type": "text",
            "uuid": "7b5bb89d-cf87-4665-83b6-7adfa0bf1707",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:31/62\nFirst Submission:2026-02-03T13:04:18.000000+00:00\nLast Submission:2026-02-03T13:04:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442343",
        "uuid": "da7b4fa8-5356-418d-b2d0-ad8dc21b3613",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442343",
            "to_ids": true,
            "type": "md5",
            "uuid": "588118f8-cc5b-4101-bd63-2f924d2c0db9",
            "value": "8ca36b9cbd72d1f4ab4a9c8fcf85fe7e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367222",
            "to_ids": true,
            "type": "sha1",
            "uuid": "00d19413-df52-4ee2-9d28-0cb6a56ee482",
            "value": "4f29c2059dcba412c3ef0100e839cf85fb0f62c1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367222",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1272bf59-e10b-4990-8958-546fcd64135f",
            "value": "bf338d88f60c0d352cd0d1b5e4bc6a1d9f1ac8fe1df48516ec0042cafda821e9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366681",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3de8f660-2c23-4673-9873-16e4932f3fb7",
            "value": "24:8hQWJmlK2UjcOACe+/5+Ux4MaufDCEq9nYg/izm:8hGlr3qF4mbCJY6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366681",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b305ed5d-6242-4884-ac0f-b07239842e51",
            "value": "1213"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366681",
            "to_ids": true,
            "type": "vhash",
            "uuid": "52aee89c-22b5-4487-97a7-28a1c0a91ebb",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366681",
            "to_ids": true,
            "type": "filename",
            "uuid": "1c0281e2-6c80-44f7-b784-5018e0778687",
            "value": "\u0420\u043e\u0442\u0430 \u0437\u0430\u0431\u0435\u0437\u043f\u0435\u0447\u0435\u043d\u043d\u044f.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_bSU3CQN_vy.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366681",
            "to_ids": false,
            "type": "text",
            "uuid": "22d03cd2-7b05-41a8-8bd1-e56f24ecea70",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:28/61\nFirst Submission:2026-03-05T13:29:01.000000+00:00\nLast Submission:2026-03-05T13:29:01.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442365",
        "uuid": "7e1fc6db-ae56-42da-b6b3-4cd10de97cd6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442365",
            "to_ids": true,
            "type": "md5",
            "uuid": "5a5f3e29-87ac-4f43-b4ce-3c3b1e781db4",
            "value": "4082096ec0b8f723a79a224a6b6d37cd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367224",
            "to_ids": true,
            "type": "sha1",
            "uuid": "017f56d7-26e0-4f66-bcdb-d988c212fbd9",
            "value": "02462fa8f816b2ff21898612552d7845abcb9070",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367224",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ef617f2f-148d-42b6-a763-e4a24882a30e",
            "value": "f668bd551859007cf2cc2a62bf0bf5414870a04e9782590c9bf85c849ddb308b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366703",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e8e92cb9-a3ab-40df-9a4f-bb4beaa5bd02",
            "value": "24:8xYQWJeMid9M4ACe+/5+nX4pmHAWq9nYg/izm:8xY+dIfq+X4pmHAjY6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366703",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7809adde-350e-43e9-841d-5a5e06f81642",
            "value": "1203"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366703",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ab4879ce-fd05-4149-8954-7f70ddefa2a3",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366703",
            "to_ids": true,
            "type": "filename",
            "uuid": "00edae06-2452-44a7-a015-df55aa705a12",
            "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260409-7496423-1.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_ojMP31J28ohEDxT.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366703",
            "to_ids": false,
            "type": "text",
            "uuid": "10ff650d-d74a-4be2-9436-1b2e92573687",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:36/62\nFirst Submission:2026-04-09T09:20:26.000000+00:00\nLast Submission:2026-04-10T06:23:13.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442386",
        "uuid": "6144733f-cece-4ef6-93d7-88b55d42a198",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442386",
            "to_ids": true,
            "type": "md5",
            "uuid": "16e15f67-8407-449d-9665-472b9852db85",
            "value": "ea610ea6a8d69cb1e93fb79d4a8fa26f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367224",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c3845152-7703-4064-a93b-b21fe7f3aab1",
            "value": "42428f21b0114e390c6129f1fb24b42e97a8f7f7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367224",
            "to_ids": true,
            "type": "sha256",
            "uuid": "19d41746-eeef-4e87-af5f-1f0b60d93dde",
            "value": "f9d2907d6b1de3078a0f111cc98764a92baf5ebd06cc8ab02637a65eff3b7f3a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366724",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "020e0677-31f2-46af-b5c5-13f723c5adcf",
            "value": "24:8iQWJml1Ul9XACe+/5+nX4X0huqkq9nYg/izm:8iGl1fq+X4khdpY6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366724",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4447ddc9-dac0-4b3b-92ea-d853b176cdc7",
            "value": "1203"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366724",
            "to_ids": true,
            "type": "vhash",
            "uuid": "85a37141-76f1-4cc0-8339-09701e0c5004",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366724",
            "to_ids": true,
            "type": "filename",
            "uuid": "44c9a3ab-8725-4ae3-bd85-acdd9e03d525",
            "value": "2523_18618928.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_QhVES3g47D9.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366724",
            "to_ids": false,
            "type": "text",
            "uuid": "47724e2f-aace-4b62-b402-02384a2d8807",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:32/61\nFirst Submission:2026-02-03T08:58:18.000000+00:00\nLast Submission:2026-02-03T08:58:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442407",
        "uuid": "e5690ee2-25b2-490b-b3f6-5551e9f592d4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442407",
            "to_ids": true,
            "type": "md5",
            "uuid": "0fbb46df-cf51-4388-86aa-cd5226e080bf",
            "value": "7a6f180d3881c5c46f5c043cd45d4c65",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367226",
            "to_ids": true,
            "type": "sha1",
            "uuid": "f0cc0ba8-7915-4662-abe4-b804e01fbb9e",
            "value": "1ef95fe07e8f39b5bec2ac2636011d25ee96f22a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367226",
            "to_ids": true,
            "type": "sha256",
            "uuid": "80f99c6f-e48a-4354-b007-e7d9337b1682",
            "value": "0a9bc91e7ea2c3931f662eea37c00c7c26c8996b65f6f7afe6cce8f6114f94b6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366746",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5285b3b3-1b2a-40e3-b6d9-8c8ab0ee59ae",
            "value": "24:8qQWJcgr4QACe+/5+nX4BnfgHOUq9nYg/izm:8q8Rq+X4h4HO5Y6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366746",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a1d26b12-80d3-4967-9a54-d88a65594e17",
            "value": "1203"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366746",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4c7020c4-2e51-4d0c-8cc5-17f3da3c2956",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366746",
            "to_ids": true,
            "type": "filename",
            "uuid": "fb8dbd82-c662-46d5-8e06-130b665659e0",
            "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e \u0441\u0430\u043c\u043e\u0432\u0456\u043b\u044c\u043d\u0435 \u0437\u0430\u043b\u0438\u0448\u0435\u043d\u043d\u044f \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0457 \u0447\u0430\u0441\u0442\u0438\u043d\u0438 3018-4726.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_x3U_F_q1KeVOd3_.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  22/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366746",
            "to_ids": false,
            "type": "text",
            "uuid": "57a757fe-2a7a-4833-86aa-9aea20659b82",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:26/62\nFirst Submission:2026-06-07T15:57:14.000000+00:00\nLast Submission:2026-06-07T15:58:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442428",
        "uuid": "8b36e3d4-13d2-43e6-9d3b-4960135d6189",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442428",
            "to_ids": true,
            "type": "md5",
            "uuid": "b3eb98fa-0418-475c-ad86-0f1b314a2f61",
            "value": "13772e08c6a0aedcfdeb8fc0fe72a825",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367227",
            "to_ids": true,
            "type": "sha1",
            "uuid": "481c7e6b-1e7a-458f-b80d-c2edb74ad877",
            "value": "3603ce64bf0e00d375574960ab63ef54e55503ca",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367227",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cdd0bbaf-2292-4a17-a40e-7362bebb3bee",
            "value": "39dd1bd3bccc314d8933e5c41ed2ab084e4e20af569f77b7cf09abc5855b9483",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366768",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "47d4c563-c66a-466b-8792-e7122cd0a114",
            "value": "24:8MQWJcgr4QACe+/5+Ux4DaDh9C9kq9nYg/izm:8M8RqF4yh9C9pY6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366768",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "924b5ccf-9fdd-4489-9072-b887d1d70892",
            "value": "1213"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366768",
            "to_ids": true,
            "type": "vhash",
            "uuid": "889c96d8-fc4f-499a-9052-371338ce1478",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366768",
            "to_ids": true,
            "type": "filename",
            "uuid": "92fd0e7c-5878-4262-96aa-a2d59e8824ae",
            "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e \u0441\u0430\u043c\u043e\u0432\u0456\u043b\u044c\u043d\u0435 \u0437\u0430\u043b\u0438\u0448\u0435\u043d\u043d\u044f \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0457 \u0447\u0430\u0441\u0442\u0438\u043d\u0438 3018-4908.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_U0asnHrRyNSI5H4.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  22/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366768",
            "to_ids": false,
            "type": "text",
            "uuid": "590668e1-be3a-48e7-b096-a203b657d0de",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:30/61\nFirst Submission:2026-06-05T07:42:56.000000+00:00\nLast Submission:2026-06-05T07:42:56.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442449",
        "uuid": "780cf1df-5099-43da-9ce2-00200f5895a8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442449",
            "to_ids": true,
            "type": "md5",
            "uuid": "7b9e43da-13ac-432b-8e49-213619610816",
            "value": "f6edb3129d600e892e68527b10292f31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367228",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fbd3a0fb-9ea5-461d-a70f-94024c464056",
            "value": "a0317dc37c137698b7b9c9c21efafa42453c7fae",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367228",
            "to_ids": true,
            "type": "sha256",
            "uuid": "50fd11f4-d076-41a6-9a56-9e80ac53b103",
            "value": "1ebbdf3671cd5ca25a8a8e7ca2f6e46dd22c631e01bfcc5c909ae2fd680bf458",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366790",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "d730f769-1f86-463c-a6fb-bd293ecd2539",
            "value": "24:8IQWJQ2uP/+8ACe+/5+cNv4EYqNuUq9nYg/izm:8IwnwqLNv4EvNu5Y6k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366790",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9b6aab27-3804-4544-ae09-fc1567b01a4c",
            "value": "1205"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366790",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e8f58461-24d0-4be9-ad69-d14947df3fba",
            "value": "c7a10c5a7b2a8b203eaca2239715ccf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366790",
            "to_ids": true,
            "type": "filename",
            "uuid": "81e6913a-4b87-4aaf-8577-61689346d422",
            "value": "1070_26782818.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_U061m7RlE5py.lnk"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  22/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366790",
            "to_ids": false,
            "type": "text",
            "uuid": "f769d646-ee56-4a46-b0bf-eb58fd6a74e6",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:31/57\nFirst Submission:2026-05-28T12:23:18.000000+00:00\nLast Submission:2026-05-28T12:23:18.000000+00:00"
          }
        ]
      }
    ]
  }
}