{
  "Event": {
    "analysis": "1",
    "date": "2026-04-15",
    "extends_uuid": "",
    "info": "[Threat Intel] CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace",
    "protected": false,
    "publish_timestamp": "1776767192",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1776767191",
    "uuid": "b3e3713c-04bb-4b7c-a176-11304fcfb57c",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#b672a4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task/Job - T1053\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#08b028",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"vulnerability\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#1a0065",
        "local": false,
        "name": "rectifyq:topic=\"crypto-related\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#dd2e44",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"germany\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776337208",
        "to_ids": false,
        "type": "link",
        "uuid": "6347a517-fcdd-4f9b-be39-2dde98d07c65",
        "value": "https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776337208",
        "to_ids": false,
        "type": "text",
        "uuid": "33891f51-5ac7-40f7-a8c6-7001e13ddb40",
        "value": "Three days after disclosure of a critical pre-authorization remote code execution vulnerability in the marimo Python notebook platform, multiple threat actors deployed malware hosted on HuggingFace Spaces. A previously undocumented NKAbuse variant was delivered through a typosquatted HuggingFace Space, utilizing NKN blockchain for command and control. Between April 11-14, 2026, eleven unique source IPs across ten countries generated 662 exploit events. Attack patterns included reverse shell campaigns, credential extraction targeting AWS keys and API tokens, DNS exfiltration, and lateral movement to PostgreSQL and Redis databases via leaked credentials. The malware binary was disguised as a legitimate Kubernetes tool named kagent and implemented persistence through systemd services, crontab entries, and macOS LaunchAgents. This operation demonstrates threat actors specifically targeting AI/ML infrastructure and leveraging trusted platforms for malware distribution."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776337208",
        "to_ids": false,
        "type": "text",
        "uuid": "4d1af3b3-594a-439a-bf14-6fa2a40b09d7",
        "value": "Name: CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace\nAuthor: AlienVault\nAdversary: \nTags: [\"huggingface\", \"cve-2026-39987\", \"nkn blockchain\", \"marimo\"]\nTgtd countries: []\nMlwr families: [\"NKAbuse\", \"kagent\"]\nAttack_ids: [\"T1033\", \"T1071.004\", \"T1053.003\", \"T1021.004\", \"T1082\", \"T1053\", \"T1140\", \"T1190\", \"T1016\", \"T1090\", \"T1083\", \"T1552.001\", \"T1059.004\", \"T1571\", \"T1573.002\", \"T1095\", \"T1059.006\", \"T1543.001\", \"T1027.002\", \"T1543.002\", \"T1105\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776337208",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "4b719d75-211f-4dc2-a05e-86d3e99a80f9",
        "value": "CVE-2017-5638"
      },
      {
        "category": "Network activity",
        "comment": "env | grep keys\r\nSource IPs may be proxies or VPN endpoints rather than operators\u2019 origins.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776765301",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fe3b3853-1889-4305-a7a2-086e67d47a53",
        "value": "111.90.145.139",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"malaysia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692483",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "df1f41cf-d2a2-40bf-bd66-f5eb00fe769d",
        "value": "160.30.128.96",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776337208",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "9528bc5e-d0b7-4798-ab79-708acaf34ebc",
        "value": "CVE-2026-39987"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692504",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f4671185-0484-472c-bfb8-0006fec8814d",
        "value": "185.225.17.176",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692525",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7f9fac30-6e9d-48d7-855d-7bf68969e170",
        "value": "38.147.173.172",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:20/04/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692001",
        "to_ids": true,
        "type": "md5",
        "uuid": "1dab5a8c-d668-4ca1-99cb-8d6081774388",
        "value": "1d36de06a6240919189cb46e0bcccc3c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:20/04/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692002",
        "to_ids": true,
        "type": "sha1",
        "uuid": "a066800a-d757-4f97-97c9-8b1ab22e69a1",
        "value": "9c363fbcc86662ce15cee15e5dd16b71b769ceb4",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:20/04/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692003",
        "to_ids": true,
        "type": "sha256",
        "uuid": "dda2adb6-dae6-4de0-9be4-0b46b0f5e2ab",
        "value": "25e4b2c4bb37f125b693a9c57b0e743eab2a3d98234f7519cd389e788252fd13",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:20/04/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692004",
        "to_ids": true,
        "type": "sha256",
        "uuid": "04a8e0ef-d4d9-47da-ab7b-a51d8f7b1562",
        "value": "f2960805f89990cb28898e892bbdc5a2f86b6089c68f4ab7f2f5e456a8d0c21d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692547",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e5740a44-b7fc-4e93-8280-cf730ae5fe8e",
        "value": "120.227.46.184",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692568",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "20542143-7ff3-42f7-b98b-ad5719fca8c8",
        "value": "185.187.207.193",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692589",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f4d2131e-79e9-4c72-85cb-4cb801df9f3a",
        "value": "45.147.97.11",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692610",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3e022abd-fb0e-406e-beaa-a430a315071d",
        "value": "60.249.14.39",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692631",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "669d822a-a223-4ef6-a321-0ecbc5d57c03",
        "value": "92.208.115.60",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692652",
        "to_ids": true,
        "type": "hostname",
        "uuid": "33334ab2-f121-4487-a149-9cb60fe0adc1",
        "value": "bskke4.dnslog.cn",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692673",
        "to_ids": true,
        "type": "url",
        "uuid": "e7838da4-41cf-4a52-81e8-10d05d4a43c1",
        "value": "https://vsccode-modetx.hf.space/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692695",
        "to_ids": true,
        "type": "url",
        "uuid": "bc790f7c-182b-4d1f-a8f1-313deb839baf",
        "value": "https://vsccode-modetx.hf.space/install-linux.sh",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692716",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3bfadb-131f-4251-9da6-024fffdc01af",
        "value": "https://vsccode-modetx.hf.space/kagent",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692737",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e40214bc-f245-4051-a658-658007454bce",
        "value": "203.10.98.186",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776764997",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5941c210-1258-4f56-a411-eaa8b928c074",
        "value": "159.100.6.251",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776692781",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "160602ac-7952-4fa4-abc0-7507cc20bffb",
        "value": "185.188.61.216",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1776692802",
        "uuid": "5cb53004-9298-4105-b556-b71eff3c114c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1776692802",
            "to_ids": true,
            "type": "md5",
            "uuid": "8c391b21-1917-4b1f-8c12-3863a37e0345",
            "value": "bdcb5867f73beae89c3fce46ad5185be",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1776691999",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e2d7b7ce-69f6-4753-87eb-805ad64991e9",
            "value": "049c35fa746a8b86c100bf6b348ef6163b215898",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1776692000",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e52283a6-ad64-43de-b8ee-9308ad282690",
            "value": "27c62a041cc3c88df60dfceb50aa5f2217e1ac2ef9e796d7369e9e1be52ebb64",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1776689092",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4a8b54ba-d57e-4049-9ad7-93986ba605e9",
            "value": "98304:ItvpcxuusvWHVsQ31g5WJRJoL4qrujA+pcjLqkaPNcXBNkN5z+:EBcxuu1sQFt/JoLhCIGkZRuT+"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1776689092",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f5e01c60-f8e1-4f79-81bc-f568a6c53dd6",
            "value": "4553432"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1776689092",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7d7fe209-3c8d-4957-a202-5a606d4fc8d1",
            "value": "c0e5296cd292fda3935605777477d380"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1776689092",
            "to_ids": true,
            "type": "filename",
            "uuid": "2b70336a-53f8-42d6-8f4c-f110bfba1ba5",
            "value": "kagent"
          },
          {
            "category": "Other",
            "comment": "Checked: 20/04/2026\nLast-scan\t:  18/04/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1776689092",
            "to_ids": false,
            "type": "text",
            "uuid": "c584d56c-1b08-424b-95f4-b3a9a14a3cf1",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:3/65\nFirst Submission:2026-04-17T22:04:01.000000+00:00\nLast Submission:2026-04-17T22:04:01.000000+00:00"
          }
        ]
      }
    ]
  }
}