{
  "Event": {
    "analysis": "1",
    "date": "2026-05-29",
    "extends_uuid": "",
    "info": "[Threat Intel] Sapphire Sleet Targets macOS",
    "protected": false,
    "publish_timestamp": "1780377456",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780377455",
    "uuid": "9805a443-f7d8-4233-9c46-75dea24852bb",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Lazarus Group\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"STARDUST CHOLLIMA\"",
        "relationship_type": ""
      },
      {
        "colour": "#680082",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"MacOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052416",
        "to_ids": false,
        "type": "link",
        "uuid": "26a77505-d78e-46a1-9cfa-2cb193b6d6e3",
        "value": "https://www.levelblue.com/blogs/spiderlabs-blog/sapphire-sleet-targets-macos-in-multi-stage-intrusion-campaign"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052416",
        "to_ids": false,
        "type": "text",
        "uuid": "2dc6e5ac-da1b-481c-9346-d7fd98281db5",
        "value": "We recently observed a multi-stage macOS intrusion campaign conducted by the North Korean state-sponsored threat group Sapphire Sleet (also tracked as BlueNoroff / UNC1069). The campaign specifically targets macOS environments within high-value financial sectors, including venture capital firms, Web3 developers, and cryptocurrency organizations. By leveraging signed, built-in system applications like the Apple Script Editor and Finder, the malware operates outside traditional macOS security enforcement boundaries, suppresses system security alerts, and executes arbitrary code directly under the guise of an authentic user update. This aligns with broader public reporting on macOS-focused intrusion tradecraft. Initial access relied on targeted social engineering in which victims were instructed to execute a fake Zoom SDK update component, leading to user-assisted execution and follow-on payload delivery."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780052416",
        "to_ids": false,
        "type": "text",
        "uuid": "987728d0-14ec-4138-a3d0-ba7b5dc59c2f",
        "value": "Name: Sapphire Sleet Targets macOS\nAuthor: AlienVault\nAdversary: \nTags: []\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373474",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "be1243f4-b8f5-4b8d-8018-dec4b3ce8f51",
        "value": "83.136.209.22",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373495",
        "to_ids": true,
        "type": "domain",
        "uuid": "bf0657d2-beda-4d25-991d-de5f1d135fe2",
        "value": "uw04webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373516",
        "to_ids": true,
        "type": "domain",
        "uuid": "b326ad3a-e3df-44b3-87f2-764e31dce3cd",
        "value": "ur01webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373538",
        "to_ids": true,
        "type": "domain",
        "uuid": "a287bdfb-db6d-4eb5-ae7f-ae0466ddd5fe",
        "value": "uv01webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370746",
        "to_ids": true,
        "type": "sha256",
        "uuid": "233a1d42-e9e3-40a5-8f92-28a617e49a3d",
        "value": "2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370748",
        "to_ids": true,
        "type": "sha256",
        "uuid": "173ce184-cd5e-4e95-8c28-d9be544b3ea2",
        "value": "5e581f22f56883ee13358f73fabab00fcf9313a053210eb12ac18e66098346e5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:02/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780370749",
        "to_ids": true,
        "type": "sha256",
        "uuid": "24aad00b-77bc-4501-8af3-67b366180ff7",
        "value": "95e893e7cdde19d7d16ff5a5074d0b369abd31c1a30962656133caa8153e8d63",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373559",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b6576789-b971-4378-a9df-5324fb52cdad",
        "value": "104.145.210.107",
        "Tag": [
          {
            "colour": "#728fa5",
            "local": false,
            "name": "asn:asn=\"398256\"",
            "relationship_type": ""
          },
          {
            "colour": "#5cc9ea",
            "local": false,
            "name": "asn:as-owner=\"AS-ULTAHOST\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373580",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bc4f76ac-5c3b-41b8-b3ba-279870d6d95f",
        "value": "83.136.208.246",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373601",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0a4088fc-9f29-4f7f-8312-a965e5ecc25a",
        "value": "83.136.208.48",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373622",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b8b19827-3fe8-4afd-a878-d62ebf031f38",
        "value": "83.136.210.180",
        "Tag": [
          {
            "colour": "#a7093b",
            "local": false,
            "name": "asn:asn=\"400897\"",
            "relationship_type": ""
          },
          {
            "colour": "#c008f8",
            "local": false,
            "name": "asn:as-owner=\"PETROSKY\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373643",
        "to_ids": true,
        "type": "domain",
        "uuid": "702f1b28-9d89-4296-9718-8a5775c95e1a",
        "value": "check02id.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373665",
        "to_ids": true,
        "type": "domain",
        "uuid": "33808bc3-9e4d-41d4-8fb0-86e4e37b2faa",
        "value": "uv03webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373686",
        "to_ids": true,
        "type": "domain",
        "uuid": "1c2c2635-4461-47ff-8ba5-1327fc280857",
        "value": "uv04webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373707",
        "to_ids": true,
        "type": "domain",
        "uuid": "16978a5d-b66a-4cc2-b61d-34c07fe2f440",
        "value": "uw03webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373728",
        "to_ids": true,
        "type": "domain",
        "uuid": "7200a9de-9cfb-4f53-8583-49c9487e2286",
        "value": "uw05webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780373750",
        "to_ids": true,
        "type": "domain",
        "uuid": "e69ece69-b71b-4f21-b201-0c4ae9c3d873",
        "value": "ux06webzoom.us",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780205146",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "ab051881-e1a0-4f27-9780-06408df8bc15",
        "value": "Sapphire Sleet",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"Lazarus Group\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"STARDUST CHOLLIMA\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373771",
        "uuid": "8a9511d4-5761-48c4-8247-c9ff3af6c154",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373771",
            "to_ids": true,
            "type": "md5",
            "uuid": "c8e34f3d-efe1-4981-868d-86effbac71be",
            "value": "1b5c78314e947ddf81cf9a59cd2a3029",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370742",
            "to_ids": true,
            "type": "sha1",
            "uuid": "cff84baa-4753-412d-993a-7ad93936e0af",
            "value": "38c2970b855d1f15bcd695cd2a5873394be5ccb4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370742",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e72205af-0fe8-4459-a61b-ed02ef2c58bd",
            "value": "05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369168",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "24df4fcf-5c15-4f2d-aa2b-a65643eff39b",
            "value": "98304:8tWy/xdXmuJ+mcSkKi6xPbBCguDTRIaOG0wvgIBn2YRURm8INbO65d:8xvXmu6SvPoguDTRHOG0wv4YSRQNq6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369168",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a446944e-9fc1-43a6-915d-d846bd722683",
            "value": "5246536"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369168",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9063ddaf-10e1-4077-9af0-4c6d767e4026",
            "value": "e77891e9cac024e7fdbbe145962206f5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369168",
            "to_ids": true,
            "type": "filename",
            "uuid": "cfefddfb-e7d1-46e5-8bdb-79859dc05bd4",
            "value": "05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53.macho"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369168",
            "to_ids": false,
            "type": "text",
            "uuid": "01927390-5279-4d37-8583-93d1fd944084",
            "value": "Type Description: Mach-O\nMicrosoft: Backdoor:MacOS/FlowOffset.B!dha\nVT Total Detection:35/63\nFirst Submission:2026-01-29T08:53:07.000000+00:00\nLast Submission:2026-04-08T07:46:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373792",
        "uuid": "fa995cdc-7b97-41dd-974e-aa5fc96811e6",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373792",
            "to_ids": true,
            "type": "md5",
            "uuid": "109f3b00-1c3c-4970-918e-ed4b6e054558",
            "value": "68a8bbcb7b30c25dcca741ff7a67d36b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370743",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ea856af9-18b1-4a9b-85a7-99206e79e0b7",
            "value": "d0fc58c7aa07855d341f4b92d70ea05008574a2d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370743",
            "to_ids": true,
            "type": "sha256",
            "uuid": "365bc82d-36bb-4c44-927c-fe735349d806",
            "value": "5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369232",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7631d2cd-4ba9-4df9-868f-3d2125f6a858",
            "value": "98304:t8uj/T/bQVW1T/d8QV6ZRHHLRLm3Hrld3wDiutAudt9HvzSJxOVSX98Noq66FWY9:tn/iWTF7V6ZRLRmL3wDptAudtZzAOZW4"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369232",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e6bce21f-a00b-4821-b17e-8587f131ae32",
            "value": "5565952"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369232",
            "to_ids": true,
            "type": "vhash",
            "uuid": "53173839-d2ef-44af-a5a4-de0ee4a3a1c0",
            "value": "fc6cd2674c5d8934c84f3bce9ca3223a"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369232",
            "to_ids": true,
            "type": "filename",
            "uuid": "6319a335-bb72-43b5-9dc3-d5eee833a18b",
            "value": "5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7.macho"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  28/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369232",
            "to_ids": false,
            "type": "text",
            "uuid": "697fadc0-4756-4191-bd42-30c6f9c49091",
            "value": "Type Description: Mach-O\nMicrosoft: Backdoor:MacOS/FlowOffset.C!dha\nVT Total Detection:35/63\nFirst Submission:2026-02-03T19:38:55.000000+00:00\nLast Submission:2026-05-06T09:23:11.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373813",
        "uuid": "94647362-2f8c-4a0e-9d3b-7a4b551bcc33",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373813",
            "to_ids": true,
            "type": "md5",
            "uuid": "4fba4c0f-47d9-47fa-a0d6-c981555021ed",
            "value": "d6511c84da303ed2a93dab5c91538b7d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370744",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7c0d39c9-5c36-419e-8646-d8e5810d037c",
            "value": "e47a68b3c0d40178e41c817b309da9c4462b4793",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370744",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e2fbc561-7e11-49d5-8d90-53f536bfd323",
            "value": "8fd5b8db10458ace7e4ed335eb0c66527e1928ad87a3c688595804f72b205e8c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369254",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f1030f87-87a4-45e0-b32e-a57f3e8a46a2",
            "value": "6144:NzC/A/9Ncae6O+swtWVu0AGv2I2xklMMYjq5:Nzj/6wWVu0AXIBlM"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369254",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "59bcdb80-00f7-4078-9bb0-b80ac7e906e0",
            "value": "556208"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369254",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ff12c778-07b9-44a6-bc6d-86b157921042",
            "value": "ba11f5f78b61e399d98c11360f079e29"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369254",
            "to_ids": true,
            "type": "filename",
            "uuid": "c7439e25-0ad2-44ac-b8f4-f5465cb24075",
            "value": "ammad.Mac-Password-Popup"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  01/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369254",
            "to_ids": false,
            "type": "text",
            "uuid": "cd4e0369-5b27-43d2-84b6-8194c769754e",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/FlowOffset.D!dha\nVT Total Detection:33/63\nFirst Submission:2025-11-28T08:18:04.000000+00:00\nLast Submission:2026-05-06T09:59:35.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780373834",
        "uuid": "8eac3fb5-e012-4cfe-a9e1-22b0d4011515",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780373834",
            "to_ids": true,
            "type": "md5",
            "uuid": "8be66fa4-7b57-4056-a680-2bac590c6c23",
            "value": "e5f0d28260a60c041ede761c31f324da",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780370746",
            "to_ids": true,
            "type": "sha1",
            "uuid": "22149a41-1f69-4bc9-8b80-29b0a725195f",
            "value": "f8dacf0d163c63561a14593d19f356a2054b08b6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780370746",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ddc4e737-0d70-4e18-9272-fd40b1daf90a",
            "value": "a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780369297",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9a7d74dc-a351-41e4-a0b5-c442f8631470",
            "value": "3072:+j5ayec6tXan63CMM2uOo3oKcGl4XX4WnsAsua6PopKYXNz0z14WR8fz+gicP4Wy:+z6Ba6SMypcm4XoesQo4qAza88Ir9s"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780369297",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a1cb625c-4663-4fe0-b0dd-3d368ae9a686",
            "value": "452480"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780369297",
            "to_ids": true,
            "type": "vhash",
            "uuid": "1b76349d-0e32-478b-ba82-e82985e48b36",
            "value": "faebb11e01c920cf8d59ad16a0ee79cf"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780369297",
            "to_ids": true,
            "type": "filename",
            "uuid": "06bee545-8ce6-43d4-9028-5dbd89c16d65",
            "value": "a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640.macho"
          },
          {
            "category": "Other",
            "comment": "Checked: 02/06/2026\nLast-scan\t:  21/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780369297",
            "to_ids": false,
            "type": "text",
            "uuid": "96cc91ae-0162-4289-b39c-fc2164cd94d3",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/FlowOffset.E!dha\nVT Total Detection:28/63\nFirst Submission:2025-11-28T07:39:09.000000+00:00\nLast Submission:2026-02-06T21:11:11.000000+00:00"
          }
        ]
      }
    ]
  }
}