{
  "Event": {
    "analysis": "1",
    "date": "2026-07-16",
    "extends_uuid": "",
    "info": "[Threat Intel] GoSerpent backdoor attacks in Southeast Asia",
    "protected": false,
    "publish_timestamp": "1784588106",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784588106",
    "uuid": "c016667b-8e3a-4d62-8252-c59dd3d93934",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Kaspersky\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8efd0f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Account Manager - T1003.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#041edc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#657ac3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"",
        "relationship_type": ""
      },
      {
        "colour": "#07ff3c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8bde06",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"NTFS File Attributes - T1564.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#c295b4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#fdcb58",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"somewhat-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Government, Administration\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"MimiKatz\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"STOWAWAY\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"TetrisPhantom\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257212",
        "to_ids": false,
        "type": "link",
        "uuid": "682a3502-ed6a-4b26-b3ec-2168ddc9930d",
        "value": "https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257212",
        "to_ids": false,
        "type": "text",
        "uuid": "ca47703a-4f32-40a4-81ed-b10578a726b3",
        "value": "Since late 2025, government and diplomatic entities in Southeast Asia have been targeted by sophisticated attacks involving GoSerpent, a Go-based RAT with proxy capabilities. The malware receives encrypted arguments and deploys additional tools for data collection and credential dumping. GoSerpent has been active since 2021, with newer variants using AES-CBC encryption and ChaCha20 for communications. The campaign involves multiple stages: initial deployment of GoSerpent and ThumbcacheService to collect sensitive files, credential dumping via Mimikatz and QuarksDumpLocalHash, followed by deployment of Stowaway RAT in May 2026 and TmcLoader/TmcPayload for stealthy data exfiltration through network shares. The integrated toolset demonstrates sophisticated operational planning, with attackers leveraging Alibaba Cloud and UCLOUD HK infrastructure while exhibiting possible connections to the TetrisPhantom threat actor."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257212",
        "to_ids": false,
        "type": "text",
        "uuid": "0645d9b5-4b60-4f48-9105-352874d59d2d",
        "value": "Name: GoSerpent backdoor attacks in Southeast Asia\nAuthor: AlienVault\nAdversary: TetrisPhantom\nTags: [\"government targeting\", \"southeast asia\", \"goserpent\", \"diplomatic entities\", \"quarksdumplocalhash\", \"stowaway\", \"tmcloader\", \"tmcpayload\", \"proxy capabilities\", \"data exfiltration\", \"credential dumping\", \"mcmx\", \"thumbcacheservice\", \"mimikatz\"]\nTgtd countries: []\nMlwr families: [\"GoSerpent\", \"McMx\", \"ThumbcacheService\", \"Mimikatz\", \"QuarksDumpLocalHash\", \"Stowaway\", \"TmcLoader\", \"TmcPayload\"]\nAttack_ids: [\"T1560.001\", \"T1132.001\", \"T1003.002\", \"T1573.001\", \"T1005\", \"T1140\", \"T1055\", \"T1021.002\", \"T1572\", \"T1003.001\", \"T1090\", \"T1041\", \"T1547.001\", \"T1027\", \"T1095\", \"T1059.003\", \"T1071.001\", \"T1105\", \"T1564.004\", \"T1090.001\"]\nIndustries: [\"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784257212",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "45f69c9d-5572-47ae-8d3c-0588e0438ac6",
        "value": "TetrisPhantom"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585002",
        "to_ids": true,
        "type": "md5",
        "uuid": "d4fa3439-fb45-4190-9f12-945f226a88ad",
        "value": "ebffd5a76aaa690bcdb922f82e0bacc5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585003",
        "to_ids": true,
        "type": "md5",
        "uuid": "4472eb55-0fa8-40f2-a4eb-2738fd6fb558",
        "value": "dc506ff7bb72735444fb3703a6bee6d8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585004",
        "to_ids": true,
        "type": "md5",
        "uuid": "b11bff76-7bd4-4755-a5d5-259329aff396",
        "value": "d6e86bf8a90e9b632add5fa495f97fbc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585005",
        "to_ids": true,
        "type": "md5",
        "uuid": "27de8a6c-0292-4d45-b2fa-d45f3a70b73a",
        "value": "cb6c4c70a3b171fa3404b8e1a3382116",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585007",
        "to_ids": true,
        "type": "md5",
        "uuid": "bc840e8a-321c-436a-9aa6-5cd1ac3cbf51",
        "value": "64e9d1950e42bc98486dfd9919463d1c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585007",
        "to_ids": true,
        "type": "md5",
        "uuid": "4cdb592f-a9c9-4108-a964-bdafc764730d",
        "value": "cbbb6d483737ea3566726e51752dff40",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585008",
        "to_ids": true,
        "type": "md5",
        "uuid": "324d78b9-9fdb-4b24-9bd1-54b48e2ddb6d",
        "value": "7f223ee0716ce2ad56f55d3744419449",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585010",
        "to_ids": true,
        "type": "md5",
        "uuid": "077b32cc-c62f-481b-8191-2562853a3332",
        "value": "19f8befcb035f52bf70094e6b4f5779a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585011",
        "to_ids": true,
        "type": "md5",
        "uuid": "f6331ed6-da8e-4c5b-9116-bf0cc30e1610",
        "value": "846ef7c1c7323849b2a778c5e4cda162",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585012",
        "to_ids": true,
        "type": "md5",
        "uuid": "605d8cc8-4ede-4f07-9540-c60c731d33b4",
        "value": "d08a059e8b815e3b891505bc8777fc28",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585013",
        "to_ids": true,
        "type": "md5",
        "uuid": "572b589d-8899-4d21-b2ce-2178d41bd681",
        "value": "93a1569d5d5ab2c4761fedf84f83709e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585188",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7561d7ab-d6f1-4770-bb1c-cb305e6b9b73",
        "value": "144.48.6.46",
        "Tag": [
          {
            "colour": "#9aa09a",
            "local": false,
            "name": "asn:asn=\"997\"",
            "relationship_type": ""
          },
          {
            "colour": "#9a1b7d",
            "local": false,
            "name": "asn:as-owner=\"BSL-AS-AP Beyotta Services LLP\"",
            "relationship_type": ""
          },
          {
            "colour": "#d906de",
            "local": false,
            "name": "asn:as-country=\"SG\"",
            "relationship_type": ""
          },
          {
            "colour": "#ad61df",
            "local": false,
            "name": "misp-galaxy:country=\"singapore\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585209",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0ea6e986-4c86-46c1-b2ab-9674defc910b",
        "value": "103.138.13.30",
        "Tag": [
          {
            "colour": "#5c35dc",
            "local": false,
            "name": "asn:asn=\"138195\"",
            "relationship_type": ""
          },
          {
            "colour": "#209a3e",
            "local": false,
            "name": "asn:as-owner=\"MOACKCOLTD-AS-AP MOACK.Co.LTD\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 21/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585014",
        "to_ids": true,
        "type": "md5",
        "uuid": "652ba6fd-ef30-4596-84ea-4c2c7128ddff",
        "value": "31323334353637383930616263646566",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585231",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "afa8b2f0-eb87-45f8-b666-9c705a7a2a08",
        "value": "152.32.160.239",
        "Tag": [
          {
            "colour": "#c3a785",
            "local": false,
            "name": "asn:asn=\"135377\"",
            "relationship_type": ""
          },
          {
            "colour": "#273bfe",
            "local": false,
            "name": "asn:as-owner=\"UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585252",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2b35a74e-1e7f-4a60-a280-1b87b04b41b1",
        "value": "8.220.194.108",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585273",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "51c96f01-14d9-4199-a372-6946bb149615",
        "value": "8.220.214.132",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585294",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1376edba-135c-4de7-834a-7abe906c6aaf",
        "value": "8.220.209.155",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585315",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "06f2d8b6-9824-43a9-bca0-1dc5f01a3e37",
        "value": "8.220.193.189",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585336",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3241657c-3674-49c5-b730-d3bf78cd59f6",
        "value": "101.36.104.87",
        "Tag": [
          {
            "colour": "#c3a785",
            "local": false,
            "name": "asn:asn=\"135377\"",
            "relationship_type": ""
          },
          {
            "colour": "#273bfe",
            "local": false,
            "name": "asn:as-owner=\"UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585357",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "072387c5-36c2-4028-94fc-058dce4ccb51",
        "value": "47.80.22.58",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585378",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c128fa66-15ec-4fb7-909a-657a2181be43",
        "value": "152.32.222.113",
        "Tag": [
          {
            "colour": "#c3a785",
            "local": false,
            "name": "asn:asn=\"135377\"",
            "relationship_type": ""
          },
          {
            "colour": "#273bfe",
            "local": false,
            "name": "asn:as-owner=\"UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784585399",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f0ffb7f0-c80a-4cab-a0b6-dc580faebef5",
        "value": "43.106.30.226",
        "Tag": [
          {
            "colour": "#836891",
            "local": false,
            "name": "asn:asn=\"45102\"",
            "relationship_type": ""
          },
          {
            "colour": "#692b04",
            "local": false,
            "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}