{
  "Event": {
    "analysis": "1",
    "date": "2026-06-24",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation Endgame disrupts Amadey and Stealc",
    "protected": false,
    "publish_timestamp": "1782533501",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782533501",
    "uuid": "a3105336-253b-4fec-879b-a60c00cdbc93",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#8675c7",
        "local": false,
        "name": "misp-galaxy:producer=\"ESET\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#9edfba",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1587.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#213853",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Registry - T1552.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7eb739",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Msiexec - T1218.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e8825f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#b9ca9e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Server - T1583.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5bb38b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1588.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#73cdf4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Portable Executable Injection - T1055.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Execution Guardrails - T1480\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Amadey\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Stealc\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#150050",
        "local": false,
        "name": "rectifyq:sub-category=\"report\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#3909cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "relationship_type": ""
      },
      {
        "colour": "#cfba47",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compression - T1027.015\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#40fad1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Software - T1219.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Language Discovery - T1614.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442824",
        "to_ids": false,
        "type": "link",
        "uuid": "b60ba807-9d0f-45c0-b461-38b8792561c6",
        "value": "https://www.welivesecurity.com/en/eset-research/eset-takes-part-operation-endgame-disrupt-amadey-stealc/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442824",
        "to_ids": false,
        "type": "text",
        "uuid": "363f99b1-783b-4ddc-a20f-eeaa11b28801",
        "value": "ESET Research contributed to a global disruption operation targeting the Amadey botnet and Stealc infostealer, both malware-as-a-service offerings. The operation, coordinated by Microsoft Digital Crimes Unit, BitSight, Lumen, and MBSD, impacted approximately 50 domains and nearly 200 active IP-based command and control servers. ESET provided technical analyses, statistical information, C&C server lists, encryption keys, campaign identifiers, and affiliate-level insights gathered from three years of tracking. Both malware families operate through affiliate networks where operators deploy their own infrastructure, making disruption efforts particularly challenging. Amadey primarily functions as a modular loader distributing additional payloads, while Stealc focuses on credential theft from browsers, crypto wallets, and applications. The largest Amadey botnet cluster accounted for 34% of all samples and distributed an average of 14 payloads per victim, operating a pay-per-install model that monetized compromi..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442824",
        "to_ids": false,
        "type": "text",
        "uuid": "a536d2f2-176c-4aef-a196-49ca7a1f02c0",
        "value": "Name: Operation Endgame disrupts Amadey and Stealc\nAuthor: AlienVault\nAdversary: \nTags: [\"stealc\", \"botnet disruption\", \"danabot\", \"operation endgame\", \"lumma stealer\", \"infostealer\", \"amadey\"]\nTgtd countries: []\nMlwr families: [\"Amadey - S1025\", \"Stealc\", \"Lumma Stealer\", \"Danabot\"]\nAttack_ids: [\"T1218.011\", \"T1129\", \"T1539\", \"T1587.001\", \"T1204.002\", \"T1552.002\", \"T1218.007\", \"T1106\", \"T1140\", \"T1608.001\", \"T1195\", \"T1555\", \"T1036\", \"T1555.003\", \"T1583.004\", \"T1136.001\", \"T1588.001\", \"T1055.002\", \"T1552.001\", \"T1480\", \"T1528\", \"T1547.001\", \"T1027\", \"T1059.003\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528410",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4dffd4ea-78ce-492d-ac4b-fc0ceaf90933",
        "value": "176.124.199.207",
        "Tag": [
          {
            "colour": "#c3e702",
            "local": false,
            "name": "asn:asn=\"210644\"",
            "relationship_type": ""
          },
          {
            "colour": "#c047ce",
            "local": false,
            "name": "asn:as-owner=\"AEZA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528431",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9cc1493e-0826-4b8b-bbca-496e23d19044",
        "value": "176.111.174.140",
        "Tag": [
          {
            "colour": "#7d9bed",
            "local": false,
            "name": "asn:asn=\"212136\"",
            "relationship_type": ""
          },
          {
            "colour": "#5372f7",
            "local": false,
            "name": "asn:as-owner=\"NUBES\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528452",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "61bc9b2c-c7cf-4eb7-8aa6-29797b1a6c27",
        "value": "62.60.226.159",
        "Tag": [
          {
            "colour": "#3eb752",
            "local": false,
            "name": "asn:asn=\"214351\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c3288",
            "local": false,
            "name": "asn:as-owner=\"FEMOIT\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528473",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7193301a-1321-4f1d-89d5-654dba14a386",
        "value": "94.154.35.25",
        "Tag": [
          {
            "colour": "#a4f49f",
            "local": false,
            "name": "asn:asn=\"214943\"",
            "relationship_type": ""
          },
          {
            "colour": "#c284b2",
            "local": false,
            "name": "asn:as-owner=\"RAILNET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528494",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0733c5e9-c10d-4ce0-93e1-9263d89a75d0",
        "value": "mi.overlapsnowbound.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528516",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ff0c21df-772a-4afd-b16f-1eba2c9d230e",
        "value": "64.188.91.237",
        "Tag": [
          {
            "colour": "#96b694",
            "local": false,
            "name": "asn:asn=\"215730\"",
            "relationship_type": ""
          },
          {
            "colour": "#fcd458",
            "local": false,
            "name": "asn:as-owner=\"H2NEXUS-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528537",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5640b756-55ff-42f9-8cad-6fd551de2e3e",
        "value": "196.251.107.130",
        "Tag": [
          {
            "colour": "#9edafe",
            "local": false,
            "name": "asn:asn=\"9304\"",
            "relationship_type": ""
          },
          {
            "colour": "#26db00",
            "local": false,
            "name": "asn:as-owner=\"HUTCHISON-AS-AP HGC Global Communications Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528558",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6e6b8b9a-4dba-4693-b86c-352a2caec583",
        "value": "193.143.1.16",
        "Tag": [
          {
            "colour": "#544f50",
            "local": false,
            "name": "asn:asn=\"198953\"",
            "relationship_type": ""
          },
          {
            "colour": "#9b69c6",
            "local": false,
            "name": "asn:as-owner=\"PROTON66\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528580",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "78e4682d-f79a-4aef-8caf-2aff2a6e5e93",
        "value": "95.85.238.4",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527959",
        "to_ids": true,
        "type": "sha1",
        "uuid": "a9d76855-dcdf-4940-af1d-53b23f9583da",
        "value": "09002d4668a778853e8da5c488c6e421c0628357",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527960",
        "to_ids": true,
        "type": "sha1",
        "uuid": "d77d1f83-6e46-4a2b-a8c8-b25aaa60d61c",
        "value": "11a42ef076686cb27ba2c8845301943652a5aadc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527961",
        "to_ids": true,
        "type": "sha1",
        "uuid": "cf77e0e4-f0dc-414d-9077-702a4d520c0d",
        "value": "32d0c3300825b0bb991c4a8f1e6244f0ad2da989",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527963",
        "to_ids": true,
        "type": "sha1",
        "uuid": "52f21cfe-542b-4581-a11e-020546e4da63",
        "value": "38d744543b2051e6f749af171b5ef8d6df8aac7b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527964",
        "to_ids": true,
        "type": "sha1",
        "uuid": "cbd0c57a-68ac-487b-845c-a121ecc745b3",
        "value": "5f3f99b14243404c7cf57b40bb101244cce394bf",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527965",
        "to_ids": true,
        "type": "sha1",
        "uuid": "b48677b9-9531-4e24-a36e-c1b6131cdfc3",
        "value": "87867ad29e621bf9ebf57e1757f75090842458be",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527966",
        "to_ids": true,
        "type": "sha1",
        "uuid": "4e81308c-cd7a-4d43-814a-8a96f08433dd",
        "value": "b4101027bf2f1261402bf6318c6eb016ce249037",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527967",
        "to_ids": true,
        "type": "sha1",
        "uuid": "df080e34-5f4b-43ad-b8b2-9b4d6971167e",
        "value": "c0e178d26e1e67985a9c67e649d71d54642e0eed",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527968",
        "to_ids": true,
        "type": "sha1",
        "uuid": "b41b2b0c-53e6-4625-ae1e-28490eddb96b",
        "value": "f61e3a643f2417e1a1ab2c83bbdbfc8a7cb96756",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527969",
        "to_ids": true,
        "type": "sha1",
        "uuid": "b955ff71-12f0-4729-baf7-caec5ce7e3f2",
        "value": "ff8d2afd9d7f0a822092fee34ca55d1a3542f7ed",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528602",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b9786bce-7450-4e60-a21b-568592ae7bd6",
        "value": "188.114.96.1",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528623",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6294b75f-9989-40d5-a50b-78d00fc7e156",
        "value": "193.156.1.16",
        "Tag": [
          {
            "colour": "#7f936b",
            "local": false,
            "name": "asn:asn=\"224\"",
            "relationship_type": ""
          },
          {
            "colour": "#5c0ac5",
            "local": false,
            "name": "asn:as-owner=\"UNINETT UNINETT, The Norwegian University & Research Network\"",
            "relationship_type": ""
          },
          {
            "colour": "#91fb7b",
            "local": false,
            "name": "asn:as-country=\"NO\"",
            "relationship_type": ""
          },
          {
            "colour": "#e22b1e",
            "local": false,
            "name": "misp-galaxy:country=\"norway\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528644",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a999d92f-b310-488a-888e-f9bdc69680f6",
        "value": "194.26.192.191",
        "Tag": [
          {
            "colour": "#81c710",
            "local": false,
            "name": "asn:asn=\"210558\"",
            "relationship_type": ""
          },
          {
            "colour": "#f28bf9",
            "local": false,
            "name": "asn:as-owner=\"SERVICES-1337-GMBH 1337-SERVICES-GMBH-NETWORK\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782528665",
        "uuid": "3f89f3be-ce62-4c5f-a272-a4640010036f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782528665",
            "to_ids": true,
            "type": "md5",
            "uuid": "6d32653b-9416-425c-81cd-6a5877bad37b",
            "value": "4dba58c6e9f435c1cca607525760d0fd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782527958",
            "to_ids": true,
            "type": "sha1",
            "uuid": "32d3c285-4baa-42a7-a744-bd927c4d0b9d",
            "value": "ff8d2afd9d7f0a828592fee34ca55d1a3542f7ed",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782527958",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8e278892-fd2e-48d2-8331-8dcd6e465c50",
            "value": "d2886d86ef67a3550a4aadcf623aa785fddcd3af754b3035229647f186005b1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782525172",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f74b0f59-1c0a-4273-9fba-35fb9f729caf",
            "value": "12288:lP83dF+mKpRp++vNPokdXG78m8AfJJdI:4KpzPW8mllI"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782525172",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "254674c7-8abf-469c-98b1-b088e336651f",
            "value": "438784"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782525172",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c9c3aea8-c842-4d1c-9382-d959c2dbd14b",
            "value": "045056655d15556115z5008b7z37z33z31zc1za7z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782525172",
            "to_ids": true,
            "type": "filename",
            "uuid": "2ce16301-e080-45f9-8bcf-88d34c737278",
            "value": "d2886d86ef67a3550a4aadcf623aa785fddcd3af754b3035229647f186005b1c.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782525172",
            "to_ids": false,
            "type": "text",
            "uuid": "d132c13e-2fb9-4bec-80aa-a6819023c092",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Amadey.RDAD!MTB\nVT Total Detection:56/71\nFirst Submission:2024-10-17T16:20:41.000000+00:00\nLast Submission:2025-10-15T18:25:22.000000+00:00"
          }
        ]
      }
    ]
  }
}