{
  "Event": {
    "analysis": "1",
    "date": "2026-06-10",
    "extends_uuid": "",
    "info": "[Threat Intel] Targeted espionage against Cambodian government entities",
    "protected": false,
    "publish_timestamp": "1782058542",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782058542",
    "uuid": "a95dd958-71be-430e-b83e-eeb6eaa34c3e",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#2d0c2f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable Windows Event Logging - T1562.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#08b028",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#fdd85e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Access Token Manipulation - T1134\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#cb2c9b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d53577",
        "local": false,
        "name": "misp-galaxy:target-information=\"Cambodia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"8545fbf3-a246-4938-96a9-85a24651ebde\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": true,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": true,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": true,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": true,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": true,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781233206",
        "to_ids": false,
        "type": "link",
        "uuid": "7a75839a-be6f-4e78-9782-5726b9208b1f",
        "value": "https://www.acronis.com/en/tru/posts/behind-khmer-shadow-targeted-espionage-against-cambodian-government-entities/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781233206",
        "to_ids": false,
        "type": "text",
        "uuid": "94acb66e-cc20-481f-9cc1-db3361f1c9bc",
        "value": "Acronis Threat Research Unit identified two espionage campaigns targeting Cambodian government entities in defense and public works sectors, attributed to a cluster tracked as Khmer Shadow. Both campaigns delivered a custom C++ loader named NIGHTFORGE through government-themed lures in self-extracting archives. NIGHTFORGE employs sophisticated evasion techniques including NTDLL unhooking and Hell's Gate syscall resolution to decrypt and execute a Havoc Demon payload in memory. The loader utilizes DLL sideloading through a legitimate VMware-signed binary (VMwareNamespaceCmd.exe) and establishes persistence via COM-based scheduled tasks. Despite advanced technical capabilities, the actor demonstrated poor operational security by reusing identical payloads and infrastructure across targets. The campaigns targeted Cambodia's Information Collection Bureau and Ministry of Public Works and Transport using meeting-themed social engineering lures."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781233206",
        "to_ids": false,
        "type": "text",
        "uuid": "93308e39-a86f-4857-b391-1650627912a7",
        "value": "Name: Targeted espionage against Cambodian government entities\nAuthor: AlienVault\nAdversary: Khmer Shadow\nTags: [\"kaynldr\", \"nightforge\", \"khmer shadow\", \"havoc demon\"]\nTgtd countries: [\"Cambodia\"]\nMlwr families: [\"NIGHTFORGE\", \"Havoc Demon\", \"KaynLdr\"]\nAttack_ids: [\"T1053.005\", \"T1071.004\", \"T1036.005\", \"T1204.002\", \"T1497.001\", \"T1566.001\", \"T1106\", \"T1140\", \"T1055\", \"T1562.002\", \"T1055.012\", \"T1027\", \"T1573.002\", \"T1134\", \"T1027.002\", \"T1071.001\", \"T1574.002\", \"T1055.001\"]\nIndustries: [\"Defense\", \"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781233206",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "f0eb5ede-1b62-4381-8543-be3c009fd85d",
        "value": "Khmer Shadow"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782033657",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ac42ce0a-78c2-4d9a-8c3a-bdff086c29d8",
        "value": "193.169.240.38",
        "Tag": [
          {
            "colour": "#0abe78",
            "local": false,
            "name": "asn:asn=\"3236\"",
            "relationship_type": ""
          },
          {
            "colour": "#fc583e",
            "local": false,
            "name": "asn:as-owner=\"SERVER server.ua\"",
            "relationship_type": ""
          },
          {
            "colour": "#02bf45",
            "local": false,
            "name": "asn:as-country=\"UA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8651e1",
            "local": false,
            "name": "misp-galaxy:country=\"ukraine\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782033678",
        "to_ids": true,
        "type": "domain",
        "uuid": "0f1cf0bf-ac32-47db-8665-5dab0e6d7004",
        "value": "linkednewsapi.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782033699",
        "to_ids": true,
        "type": "domain",
        "uuid": "e1edb01f-bba0-425f-b214-1d115b2b9b6c",
        "value": "sharingfile.cloud",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782033721",
        "to_ids": true,
        "type": "hostname",
        "uuid": "229bcbdb-ddc3-4077-8aa5-64603083313d",
        "value": "www.sharingfile.cloud",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782033742",
        "uuid": "bf5c4433-d369-4e89-bee4-24489961dbe4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782033742",
            "to_ids": true,
            "type": "md5",
            "uuid": "0f1a0d7d-f5c2-427e-8beb-9ec9b2e53440",
            "value": "03e7a4065df354a99add76e8ba7dd37b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782033517",
            "to_ids": true,
            "type": "sha1",
            "uuid": "550b0cab-5f45-4946-80c5-0119c4b20a44",
            "value": "04e7a98fb3b7738cca42557c3e2d9906d04fa2f6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782033517",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b536f546-0589-47cd-b0e0-88480d5b797f",
            "value": "1852120a84a328edd1995e633dfd2009867898a8e3f0b385e2490cf21c77a994",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782032038",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ed728ce1-1f67-4216-8c1e-b2e50016eafa",
            "value": "24576:DubsnafAPyjX7fl2wAeAPSBOz/+Sgyj73uXlSQCucEfkYlVV7n:rIj5AIYgy+XlS2tfHnd"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782032038",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8cbcfbed-aa61-4af4-b9bd-d35f14f962c0",
            "value": "1294539"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782032038",
            "to_ids": true,
            "type": "vhash",
            "uuid": "42cfcb6f-a33f-4e9c-8655-a68fbae38285",
            "value": "016066655d1d15556az8f9z3tz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782032038",
            "to_ids": true,
            "type": "filename",
            "uuid": "34f99bdf-2c72-4a3b-ae0d-15712fff5636",
            "value": "wjcvzl.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 21/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782032038",
            "to_ids": false,
            "type": "text",
            "uuid": "9d90af0f-5964-4db5-b338-d0b2a600506b",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:48/70\nFirst Submission:2026-03-10T11:59:37.000000+00:00\nLast Submission:2026-03-10T11:59:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782033763",
        "uuid": "59ef3b0f-3e3a-4371-9460-c0b1467ad35c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782033763",
            "to_ids": true,
            "type": "md5",
            "uuid": "da4d0665-0c76-4e78-819d-31b16e46d851",
            "value": "2a3f4db3ea785d1902164750b648a051",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782033518",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c51811e4-1edf-4295-a13b-3e54f02bb052",
            "value": "eec50a7a183bcca368868a314bc0e102423a7155",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782033518",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2089982b-044c-4362-a405-15c51c2f05ce",
            "value": "15278c52f4e0d8b5bbfe288a5e826ab2ebeaedb7fb85572940cf1263e384761f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782032060",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c1225918-7d85-4b90-bba6-4a6030daec36",
            "value": "1536:HP5Nd5SBFADV9Dxu8rwzGrp8nQHGxjOvlBl9dAHc9tRjTmG1Uqp:BuADV2qrpwa5j6G1Uc"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782032060",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "87f16560-8099-403f-802c-7ea16a489483",
            "value": "108543"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782032060",
            "to_ids": true,
            "type": "filename",
            "uuid": "0d8edc2b-918c-4741-b5b5-6fb05fd41bc8",
            "value": "stage2_shellcode.bin"
          },
          {
            "category": "Other",
            "comment": "Checked: 21/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782032060",
            "to_ids": false,
            "type": "text",
            "uuid": "117c56b8-5916-4dd9-bc8d-c3fb1caa9738",
            "value": "Type Description: ELF\nMicrosoft: None\nVT Total Detection:33/60\nFirst Submission:2026-04-25T05:44:37.000000+00:00\nLast Submission:2026-04-25T05:44:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782033784",
        "uuid": "dd382a1e-64a0-480c-adb1-0904e09989c4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782033784",
            "to_ids": true,
            "type": "md5",
            "uuid": "7c706fcb-1a97-432d-8781-661adc7bb78d",
            "value": "bbbb2905a67a54df811c0aecc1b3df53",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782033519",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4205719d-86b1-4d2b-9178-9e68a559ac14",
            "value": "7250a91955f85aa2794768c233b36e009b05881b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782033520",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1d829521-a1c9-4e60-a310-987d3975e64b",
            "value": "90bbfa9e7af176b85d110f4f1789cae6777fcb60813b047133c8f12caa344a17",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782032082",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1f7fdf42-bf6c-46f7-bf75-30e808e88fb3",
            "value": "1536:a5Nd5SBFADV9Dxu8rwzGrp8nQHGxjOvlBl9dAHc9tRjTmG1Uqp:4uADV2qrpwa5j6G1Uc"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782032082",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a2d83ac4-d9bb-4e86-ac44-de069795ed90",
            "value": "107008"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782032082",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f8cddc44-442f-487d-97c7-bf5f45baf72b",
            "value": "1150665d15151d051.z1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782032082",
            "to_ids": true,
            "type": "filename",
            "uuid": "550201c0-8738-47e3-a9da-af3e7e1cda25",
            "value": "gpupdate.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 21/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782032082",
            "to_ids": false,
            "type": "text",
            "uuid": "b579bf19-dd51-4f5c-a2c3-4b12af9a6c7a",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:43/70\nFirst Submission:2026-04-25T06:17:53.000000+00:00\nLast Submission:2026-06-11T14:08:35.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782033805",
        "uuid": "e7cc3f43-e29d-492e-ae6d-9afd321cee3b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782033805",
            "to_ids": true,
            "type": "md5",
            "uuid": "2a9ba9da-a134-464a-b8c8-7bf703f7cc97",
            "value": "e3b51bdcb1b55cf7cb11ef4b3872776b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782033521",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4562c171-55e3-4996-b021-7661da06a700",
            "value": "2b1ea16b6e30b796c2db549ae6e06c9550bee5c1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782033521",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b0dd33f7-e895-4427-80d6-839f37414b89",
            "value": "b3e853eee14fb7948c6907888ee07139085ba9af4231c30e97ff6236b86ca024",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782032104",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "14a007cd-4c7b-4124-b699-a973001fa258",
            "value": "24576:Xb2+CvRSEHiRkTObz4wAeAPSBOz/+Sgyj73uXlSQYmFkrz:L2hvRhHukgpAIYgy+XlSxCA"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782032104",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "24b99b4d-2745-403a-adde-89d58e3800da",
            "value": "1338175"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782032104",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3d50617d-e520-4357-82c8-2c901cb940a3",
            "value": "016086655d155d1d05555az989z3tz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782032104",
            "to_ids": true,
            "type": "filename",
            "uuid": "8c54729b-dbb1-4878-aea9-f248c4778c7a",
            "value": "CN_Contact_Work_Cambodia's_Ministry_of_Public_Works_and_Transport.pdf"
          },
          {
            "category": "Other",
            "comment": "Checked: 21/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782032104",
            "to_ids": false,
            "type": "text",
            "uuid": "dc729d75-fd9a-40cb-bc6a-a0fe8b5cdc4a",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nVT Total Detection:49/70\nFirst Submission:2026-03-10T09:18:57.000000+00:00\nLast Submission:2026-03-18T08:12:45.000000+00:00"
          }
        ]
      }
    ]
  }
}