{
  "Event": {
    "analysis": "1",
    "date": "2026-06-16",
    "extends_uuid": "",
    "info": "[Threat Intel] Android Banker with Complete Device Takeover Capabilities",
    "protected": false,
    "publish_timestamp": "1782253832",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782253832",
    "uuid": "c4f048d7-9154-4c0a-9313-9f454c1e3bce",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Zimperium\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#170059",
        "local": false,
        "name": "rectifyq:topic=\"mobile-attack\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Access Notifications - T1517\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Audio Capture - T1429\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Broadcast Receivers - T1624.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Call Control - T1616\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1414\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1637\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1646\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1417.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Input Injection - T1516\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1417.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Name or Location - T1655.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1660\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SMS Control - T1582\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SMS Messages - T1636.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1418\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1406.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1426\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665216",
        "to_ids": false,
        "type": "link",
        "uuid": "2f6eca5b-97e3-46a4-80b9-9921134c7141",
        "value": "https://zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665216",
        "to_ids": false,
        "type": "text",
        "uuid": "f179a263-2e03-48b6-87f8-828f4001f4a7",
        "value": "A newly identified Android banking trojan named Rokarolla has been discovered, distributed through malicious websites masquerading as popular applications like TikTok or Google Chrome. The malware targets 217 distinct cryptocurrency and banking applications using 137 sophisticated commands for device control. Capabilities include harvesting lock screen credentials, exfiltrating contact lists and SMS data, deploying keyloggers, blocking calls, creating fraudulent screen overlays, and disabling Google Play Protect. The infection begins with a dropper impersonating Google Play Protect that installs a secondary payload. Rokarolla communicates with C2 infrastructure via HTTPS, uses overlays to steal banking credentials and device unlock patterns, silently monitors WhatsApp contacts, hijacks SMS and calls, manipulates clipboard content for cryptocurrency theft, and employs snapshot-based screen surveillance. It maintains persistence by hiding its icon, muting device audio, and keeping screens active indefinitely."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665216",
        "to_ids": false,
        "type": "text",
        "uuid": "7c6245f1-c4bd-4243-ac19-31ae557b2d4f",
        "value": "Name: Android Banker with Complete Device Takeover Capabilities\nAuthor: AlienVault\nAdversary: \nTags: [\"rokarolla\", \"cryptocurrency theft\", \"overlay attacks\", \"banking credentials\", \"accessibility abuse\", \"sms hijacking\", \"android trojan\", \"keylogger\"]\nTgtd countries: []\nMlwr families: [\"Rokarolla\"]\nAttack_ids: []\nIndustries: [\"Finance\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235203",
        "to_ids": true,
        "type": "domain",
        "uuid": "f08749e9-2f6a-4d7c-a50c-4fbafca63e8d",
        "value": "morevoms.cfd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235224",
        "to_ids": true,
        "type": "domain",
        "uuid": "13698863-fa3a-4f8f-bbf0-29c02f28be2e",
        "value": "abiorime.cfd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235245",
        "to_ids": true,
        "type": "domain",
        "uuid": "1ca5fd2e-d461-41d2-859b-c752862f7746",
        "value": "blestorians.cfd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232964",
        "to_ids": true,
        "type": "md5",
        "uuid": "2869788a-35b0-4454-a6e1-7f6c6a8cbe69",
        "value": "53e4e5d8733569615de08e88555809e8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232965",
        "to_ids": true,
        "type": "md5",
        "uuid": "48ae69aa-dc71-4ffe-a09b-986d2d5b64d0",
        "value": "669d827d9f128959bc94797836ec2943",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232966",
        "to_ids": true,
        "type": "sha1",
        "uuid": "8b36fb03-af84-48b6-bfc3-4917df89d9b0",
        "value": "22ee22f4f8b163cbf4df4a7c4b37a90d036b2e0e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232966",
        "to_ids": true,
        "type": "sha1",
        "uuid": "f6617d5a-7de4-4652-b8e3-19a829556f7d",
        "value": "294943cf10d268d83ba8ffaa57ab38f340d5e1e1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232967",
        "to_ids": true,
        "type": "sha256",
        "uuid": "dabda934-1030-49fb-8c4b-66e5b3a5fcc3",
        "value": "97e76acebea510c8641183866be4392601314b20e73c7ba8cf1f3ee2de6080fd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232968",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e67e56c4-65ba-44e8-98b0-49f7274ee7d4",
        "value": "9a8ec3b21fdb4167f8fdd46f4d38b9a99ff2d3515ee70215438a1360c1474221",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232969",
        "to_ids": true,
        "type": "sha256",
        "uuid": "88716ce7-1b56-4fce-a7bd-ee13ce7c073e",
        "value": "c505353a6c58a21cb7b0343202e8629bee2f121f01c21dd8e0b61b7c55b77495",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232970",
        "to_ids": true,
        "type": "sha256",
        "uuid": "833c3301-86c8-4a38-b98b-01d8f1b52459",
        "value": "d7d960ef10b08c472ad397b6fd9e9481338b2077c7c2f44d3dc2c65b19345ae0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235266",
        "to_ids": true,
        "type": "url",
        "uuid": "76502386-e5de-4334-90ad-f9ecbbcace45",
        "value": "https://abiorime.cfd",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235287",
        "to_ids": true,
        "type": "url",
        "uuid": "ec66ac4c-faf6-445f-be41-da1185cb9e6f",
        "value": "https://beralisvc.info",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235308",
        "to_ids": true,
        "type": "url",
        "uuid": "fec0bdfa-2bd9-4504-9fe3-5c07c0442dc0",
        "value": "https://blestorians.cfd",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235329",
        "to_ids": true,
        "type": "url",
        "uuid": "7b255fb6-1eab-4b86-bdc8-776356c214dd",
        "value": "https://morevoms.cfd",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782235350",
        "to_ids": true,
        "type": "domain",
        "uuid": "2ae10cc4-9ec4-460c-a5bd-276eec3eb22c",
        "value": "beralisvc.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235371",
        "uuid": "1a913e9c-8998-478b-9bde-03d82d129e43",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235371",
            "to_ids": true,
            "type": "md5",
            "uuid": "f097d051-8de4-4bef-94d2-99985234ba92",
            "value": "006c773fb376e69395d078fbfeb37845",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232920",
            "to_ids": true,
            "type": "sha1",
            "uuid": "de6745e9-7a68-42af-8232-c64f707caad6",
            "value": "61e6d6b8e46eb466be8f8cd772b283037d65e30c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232920",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b5676fde-4842-4675-9c35-8349156469d2",
            "value": "8d65e4df0ad369f491698437413afd1bd55fff309860f9cdecc778c9ac062282",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231708",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6a09dbe6-c483-41bd-841e-fdca673db600",
            "value": "98304:vRo3J9DGT8W334w0Yx2+xda0Syypi37LIjQFMjz3N7mgdeqF67prHP+lugRJi/sG:0NWeYx2vnirBMjzwceqozgasP+rt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231708",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7a6adb7e-3a23-410e-894f-763440e9233c",
            "value": "8921593"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231708",
            "to_ids": true,
            "type": "filename",
            "uuid": "3bd5b760-1d3f-41dc-849f-121a660b3037",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  19/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231708",
            "to_ids": false,
            "type": "text",
            "uuid": "4ea968f2-25cd-4ecb-936a-858ce1678f48",
            "value": "Type Description: Android\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:17/65\nFirst Submission:2026-05-23T06:09:35.000000+00:00\nLast Submission:2026-05-23T06:09:35.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235392",
        "uuid": "78ad5fe9-276a-4a6b-9e3a-5695f04e981b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235392",
            "to_ids": true,
            "type": "md5",
            "uuid": "2474e281-92b4-4eb5-8fdb-f42669a7905b",
            "value": "0a91605c428936cc57079c82f58e5ab2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232922",
            "to_ids": true,
            "type": "sha1",
            "uuid": "00a84239-2a09-46ef-ac18-e9a3e14eafad",
            "value": "45e0515694788ddeb0abb3dd2a86bbc967b1eeec",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232922",
            "to_ids": true,
            "type": "sha256",
            "uuid": "27e7b2a5-db71-4806-a486-ff15424dec7e",
            "value": "3e25c28c5e93376683e841b7ad60f9383bb3bf831284a93a4aae798fc769d767",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231730",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cff5d461-54eb-4677-8ae1-3131c01a5df4",
            "value": "393216:ZkfWoSQ4tuaEdPTmNQHV9YLLYLavUu/5XhF:ZeW64tnEOpIaH3"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231730",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5c883cee-3a18-4d73-a925-4ee8e8350662",
            "value": "13220300"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231730",
            "to_ids": true,
            "type": "filename",
            "uuid": "35a90b8b-4c04-48b9-8019-eac5513651d3",
            "value": "TikTok18.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231730",
            "to_ids": false,
            "type": "text",
            "uuid": "0a586dbe-4ab6-4c2b-861b-8d9528523169",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-05-19T01:08:04.000000+00:00\nLast Submission:2026-05-19T01:08:04.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235416",
        "uuid": "d3e4ed29-26ab-4625-a3c4-151ed0e88432",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235416",
            "to_ids": true,
            "type": "md5",
            "uuid": "deb7d4ec-6057-43c6-88e6-404da2eb0ff6",
            "value": "114377794c485b464a09d8a712fdf89a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232924",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1af0665d-8d0a-42a5-b842-967cf7ed6415",
            "value": "0bcad256c661a9de209d4d148901c51be1906896",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232924",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1361600b-5fe8-4b6e-b0ca-8f6f2c2c09cd",
            "value": "726095e56c693977b7796dc7cead2e2a49551d77d3f442aaa28997615ba07e99",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231752",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b1b86a4d-66a3-4d0d-bd88-b457eb6d3436",
            "value": "196608:aqus0Bd2dGxU891nr9Mh8w4m5qs1SQBwgLwh2tIL:aqw7qM1Hw4m5quLwh2i"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231752",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3f0b784f-838e-48a7-b710-2ed3d739a0ad",
            "value": "13595861"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231752",
            "to_ids": true,
            "type": "filename",
            "uuid": "bc19586b-738b-4dae-a300-0d21918c45d4",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231752",
            "to_ids": false,
            "type": "text",
            "uuid": "6c1b1910-880d-4f37-bb34-1d42e61d8026",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:15/64\nFirst Submission:2026-04-02T03:43:26.000000+00:00\nLast Submission:2026-04-02T03:43:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235437",
        "uuid": "afe7a260-8fe6-443e-a3e7-9d9878c99b1a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235437",
            "to_ids": true,
            "type": "md5",
            "uuid": "efdcb000-4413-406b-81bd-ec95abbe09d9",
            "value": "12dd7582991eedb150605dc9b4df96d9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232925",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ae0cf809-3c4b-428a-b0bb-5af1bff694b9",
            "value": "77ad9fc130a326010e527a279d7ead7b2a0c792c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232925",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2fa2ada1-c575-4817-8334-1b17d666a901",
            "value": "e76cbdf420540a18e2ddea02938acf3c4b4139f3511d314dca9781afe1e439bb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231775",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "93283149-aead-4130-a7d6-f7850b4f826a",
            "value": "196608:gxJ6HzfvyuAQCzLG0oTbGz0X5rzjdmyWDM0ggQT/Mw05u4kzrk3LQZ39KWX:TDvolLjA1zZF6CT65KzuQDKU"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231775",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4c1273c8-dc62-4069-ad14-02d7b7543ff1",
            "value": "12268200"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231775",
            "to_ids": true,
            "type": "filename",
            "uuid": "b3c7b18a-ca76-47a2-a6d0-d85f8dc1c936",
            "value": "GoogleChrome05.24.4.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231775",
            "to_ids": false,
            "type": "text",
            "uuid": "74423148-450e-4a10-b30d-00a3572a382b",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/65\nFirst Submission:2026-05-25T07:16:14.000000+00:00\nLast Submission:2026-05-25T07:16:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235460",
        "uuid": "ce212f97-36ef-4b52-bced-d42c19370d11",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235460",
            "to_ids": true,
            "type": "md5",
            "uuid": "2df59ea2-4dcf-4cff-912d-bcb78d150915",
            "value": "18bf467368ab5197320af4c776fcc1ff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232926",
            "to_ids": true,
            "type": "sha1",
            "uuid": "84a13e14-5bc3-467d-b368-2561ee33c9ad",
            "value": "3701b8dea3a2a852039834424fc214651bc97dac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232926",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1d700dc8-fac4-44c0-923b-5e8feea57cbb",
            "value": "fe41e6c1725f63582f022a17abe098e49338a78118a00ca87785b2fa0cf3dadf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231798",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e6575ea5-04fd-426f-81c6-803c3fe9eeab",
            "value": "196608:YUffxpDitBEd8wvHKuGYThR1jpxtw08Dvn8VdCJ:YUffx9iAiJRY1n9w0fVdk"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231798",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6b553fb6-1076-42da-88a4-db0c3222a53b",
            "value": "12776162"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231798",
            "to_ids": true,
            "type": "filename",
            "uuid": "8377aefd-bd93-4b04-9100-8fb70ef9a47c",
            "value": "fe41e6c1725f63582f022a17abe098e49338a78118a00ca87785b2fa0cf3dadf.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231798",
            "to_ids": false,
            "type": "text",
            "uuid": "172c7adf-7700-4da4-93c9-222b36a62989",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/64\nFirst Submission:2026-04-17T15:17:00.000000+00:00\nLast Submission:2026-06-15T00:40:12.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235481",
        "uuid": "d594f896-a897-409c-95ac-578fe9e3e4f7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235481",
            "to_ids": true,
            "type": "md5",
            "uuid": "4ca1a7f0-4aee-4e48-9ab0-ae4e4bb9f65c",
            "value": "2b68a1032a5da7fd5c6d917c757f1483",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232927",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6be25d71-15c3-41a1-8f23-c352304f47cd",
            "value": "99c13966aa82a1af216fc967c519eb1c77abbcfc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232927",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d8723172-48ea-4787-9082-0547ea225e6b",
            "value": "62aef76c2d1897203649844b45317d9e1723819479a2b88ca4b3290ca9f4c9f0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231820",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8d10a6a2-f140-4ba9-acf9-9c7cf22dd3ef",
            "value": "98304:1JNV7l3GvpCMhpq4Cxro3d9n5c1jYo0SXYdfIxhgLINGwhJQaAm3HwoYLsECkrfX:L3ly3hJ2zEfIngLwNhbwoY5rbUBST"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231820",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "804af259-5063-4b29-bf15-05d2e75eaf9c",
            "value": "10509324"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231820",
            "to_ids": false,
            "type": "text",
            "uuid": "0d911ea8-d2bd-4fba-9db4-0e11708bd4dc",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2026-04-26T18:35:17.000000+00:00\nLast Submission:2026-04-26T18:35:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235502",
        "uuid": "9ad768c0-3216-470e-aa81-e27e7fe8a36e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235502",
            "to_ids": true,
            "type": "md5",
            "uuid": "e4967d09-6d5c-4b08-a8d6-7ab1b6d15458",
            "value": "3b5b36bf3666a37e55cca68a617a8d27",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232929",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8aef7280-ddb6-44a7-a7ce-43c586f8c094",
            "value": "23c5b055bfc35ddc5316d96e3c1a6518ed2ce444",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232929",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4af50fbb-a313-401a-9e8c-22b7eb724e81",
            "value": "48a3db92fac1ba9c218253576e09f42faabeaf48cf80663cf32e06b0a66e983d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231843",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "67da5eae-ae3f-48b2-83ae-535e7ff142ed",
            "value": "196608:o7HdBvRqG98m//xFvhDl4Qpa1imJRqY2yoA+WizzwGKYXnLnVGy5kPuLO:WdZhFvFlx4PBf9ifwGn3TVGxPeO"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231843",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "11ac8cd7-f291-4b16-878a-6faf517a9ac7",
            "value": "12887000"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231843",
            "to_ids": true,
            "type": "filename",
            "uuid": "f9ce458a-a102-4a60-a22f-9ffcc117eba9",
            "value": "TikTok18_120.0.2358.453.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231843",
            "to_ids": false,
            "type": "text",
            "uuid": "a103072b-2bae-4950-ac73-ded0c3bb56aa",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-04-24T14:26:03.000000+00:00\nLast Submission:2026-04-24T14:26:03.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235524",
        "uuid": "37b31026-2192-497b-be37-c2ce3921b41c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235524",
            "to_ids": true,
            "type": "md5",
            "uuid": "6848558d-08d9-43b6-8de3-7fb03ab6cc2d",
            "value": "41e46bdfac77abcce3fe5539e367eafb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232929",
            "to_ids": true,
            "type": "sha1",
            "uuid": "82a1e482-0262-454f-9054-31a384f7d50c",
            "value": "c43a50956de20d8afd5b3259add038b53cbaeeb7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232930",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6806f835-07cf-4d34-b2a5-385b5a066929",
            "value": "f8cb375a4129358ad5881c29a6921fc1e5773028c0b31da83298f606118b185a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231866",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "36964638-a757-4202-a729-1aa249c08b0c",
            "value": "196608:gmyasOKxRRBL6icCg5d8KzWFscNJjZ/tjk2H3ATDfX:gmrHKNBLeCgHpCaQ/mjX"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231866",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3922ed48-a530-4f7e-985d-1727da3c5075",
            "value": "11963806"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231866",
            "to_ids": true,
            "type": "filename",
            "uuid": "7ff5f139-77b4-4768-bdb3-a2c6f38be0a3",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231866",
            "to_ids": false,
            "type": "text",
            "uuid": "3f4994a1-1076-4b1d-bb51-796fa89d3b0b",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-05-05T17:21:26.000000+00:00\nLast Submission:2026-05-05T17:21:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235545",
        "uuid": "71b891c4-d90e-4d0e-9eb2-22740b245d47",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235545",
            "to_ids": true,
            "type": "md5",
            "uuid": "f02bb0fd-8288-4bec-a2d9-0644b6ec702a",
            "value": "493b92c3b3d73a5511ccd84bf578463e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232930",
            "to_ids": true,
            "type": "sha1",
            "uuid": "60e1429d-e0a1-4b55-b8c6-9405dde9ea21",
            "value": "dbbc915ba86e7b314e6082f735ed92d847dd1ef2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232930",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e05f943c-1ee2-4944-8e2a-d362a2da4b4d",
            "value": "e134cffcbe1fa8a861fd1f9a506f10ca5ff56cd5082360ef13d204676792e8bc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231888",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "58225a7d-a746-41db-943b-d5de68d80bfe",
            "value": "98304:EA7o3CMpI0SdQ9lTOpoGkxwU3dZJZIaa9dRhWqnhopkmA/r3I4Q1YDejt5c+L:GQd4lT8z0wUNZgBWqnIO5ejt5Z"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231888",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "538ffe77-72ee-4ac9-a1ff-364d8eb01d5d",
            "value": "8849858"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231888",
            "to_ids": true,
            "type": "filename",
            "uuid": "32888f8f-5d61-49fc-97db-f7bfccf7591b",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231888",
            "to_ids": false,
            "type": "text",
            "uuid": "e50e5e8a-bc56-40b5-af38-474ebf6c8a61",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2026-05-08T06:26:27.000000+00:00\nLast Submission:2026-05-08T06:26:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235569",
        "uuid": "af24d157-78b0-4372-94bd-a832bd7fab20",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235569",
            "to_ids": true,
            "type": "md5",
            "uuid": "28b993ae-5ef0-4912-93aa-1a8e5925e57f",
            "value": "4c8533c5231f023b8230abdf18d8750a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232932",
            "to_ids": true,
            "type": "sha1",
            "uuid": "782be681-6421-4383-8f99-e89d70402326",
            "value": "d9e6324d888754fee460a3577badd449f940e518",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232932",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ee35afe0-cd90-4506-9081-50fc72fc661d",
            "value": "aec2a36e8d68b23444348a7cec2d6ec287cb8810d1e190e04743645426ababb1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231911",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c0dc0aca-fa88-4521-a068-d8a2ebfce6e4",
            "value": "196608:mGYtiYj/3VdszxLrL5UijnM5xjmXngfdNFC4OvD3oKq3eDyt/aW+d0dNOV1lRx/:mGgiYrs1znLXKPpgXDjW+dGNOZ7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231911",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "39d496c3-165b-48e6-837d-09a0615af6f2",
            "value": "13733130"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231911",
            "to_ids": true,
            "type": "filename",
            "uuid": "3ddb8d26-842f-46fc-9c4f-89bc214e3b24",
            "value": "GoogleChrome05.24.2.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231911",
            "to_ids": false,
            "type": "text",
            "uuid": "97020189-fe7d-4e32-bd75-e2bfc4c8334c",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:15/65\nFirst Submission:2026-05-25T07:16:14.000000+00:00\nLast Submission:2026-05-25T07:16:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235590",
        "uuid": "980b8693-780c-4a11-bbd2-adc9127dfa36",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235590",
            "to_ids": true,
            "type": "md5",
            "uuid": "eb3a04b4-6f7a-4f7e-9027-adf63eebdb67",
            "value": "59cf6e1d2b9fa977a99e20dcd9fe07f7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232933",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ee29fd27-5c2c-4552-80f9-086f28de65b9",
            "value": "8d053559e1884e38bb13966d20003ffb34de8f6d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232933",
            "to_ids": true,
            "type": "sha256",
            "uuid": "43209865-5039-4d73-b1fc-19a4a87f9c0e",
            "value": "1e4ed7e40608750cd0bfe96f5ed493a022b58ec54da2345336c522f7c78197af",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231955",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0fd575c7-320c-4acf-9a25-c7d1c33c62a4",
            "value": "98304:mystSx+RkL0SPjjYh8ZagG6cR+o35UGo5QgdSBPbq/8KdkZClBViEKwI/3bEljZZ:myHPPYh/gG503SBPbuR6vEc/3B05WBE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231955",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0b18e0a0-f67b-4026-acc9-fe5932ea7933",
            "value": "10419433"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231955",
            "to_ids": true,
            "type": "filename",
            "uuid": "16ce26c1-2b3e-4c35-a4b6-6df5ec3fcb6a",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  19/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231955",
            "to_ids": false,
            "type": "text",
            "uuid": "1d6a00dc-8009-4ad2-b51a-cb7f5bab1beb",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/65\nFirst Submission:2026-05-26T10:31:18.000000+00:00\nLast Submission:2026-05-26T10:31:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235611",
        "uuid": "58e3b8aa-735f-4b7f-90a8-e0ead30dfc2b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235611",
            "to_ids": true,
            "type": "md5",
            "uuid": "e11eb37a-b2c4-4eed-9499-a7d269aa2176",
            "value": "617a9505680f81c08cd8223e41393a03",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232934",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5d9705d8-3590-421b-8f24-16481d57f342",
            "value": "62d67355c676d177381a9bf30e86980acddb898c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232934",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9e6345f1-a5d8-4e94-a7a2-e0ecff007881",
            "value": "a5e6763b09553691c8b42deefb725fa3b8c133a03a34cea87740b1f13d08bac3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231977",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9bc0cb32-9335-46c2-94e9-024d736dafec",
            "value": "196608:FfIBNVxWpAOkNwnXYrV83O0zjIQNv1N7QfKZ6Z0oLMlr:FsNFVyXyVAzjI6t2YKMp"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231977",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5932e64d-f9c7-426d-93d5-43a0e339f679",
            "value": "12523105"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231977",
            "to_ids": true,
            "type": "filename",
            "uuid": "3ce6488f-79a3-411e-add6-9f1e7118b380",
            "value": "GoogleChrome24.04.4.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231977",
            "to_ids": false,
            "type": "text",
            "uuid": "94dcfa48-75a2-48f6-b86b-76edd936704b",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2026-04-25T06:53:19.000000+00:00\nLast Submission:2026-04-25T06:53:19.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235633",
        "uuid": "8bf70a39-d77a-4fe8-bd98-a9e5a6ae7b45",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235633",
            "to_ids": true,
            "type": "md5",
            "uuid": "6a539960-b499-4f0b-a0fb-bf4ae802a062",
            "value": "6386b68eabc6360276f6fc88aade79e7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232935",
            "to_ids": true,
            "type": "sha1",
            "uuid": "57af3160-7e72-4e52-a579-5280606b9e0e",
            "value": "7b088a7f9b99895b23c0bd243c84558f55e27a98",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232935",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a85c007e-8fe8-4134-8275-8eaae8d2a026",
            "value": "4e2cbefc6bdbfdb6e885057ce47d460e3d3355a5e97db51b22e9c5a14e14302b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232000",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "128e2063-5253-4278-b197-524cb7cae1aa",
            "value": "98304:XuwABFfiK4O/7tNdSCkiSKbzwDznxiZllk3+MWT+ZQ/vo3SGy4nyn8XE0S9d8kBX:eVDfiWJSRiSRnx5RmHGmClWUSIJW"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232000",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "1f054785-801c-413a-8c17-9989062c259a",
            "value": "11572752"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232000",
            "to_ids": true,
            "type": "filename",
            "uuid": "39161eef-b56d-4db7-be92-73c66705af16",
            "value": "4e2cbefc6bdbfdb6e885057ce47d460e3d3355a5e97db51b22e9c5a14e14302b.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232000",
            "to_ids": false,
            "type": "text",
            "uuid": "102dfa10-2d00-4773-a85a-e4935bcef8a6",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:14/64\nFirst Submission:2026-04-14T10:07:04.000000+00:00\nLast Submission:2026-04-21T09:33:03.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235654",
        "uuid": "68176d5e-4443-4fb7-8c52-707c6e9778a7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235654",
            "to_ids": true,
            "type": "md5",
            "uuid": "39150672-e430-46f2-bc10-e8b47a8da711",
            "value": "6ef6efc798600c1007d5196d488d1a16",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232936",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8ba6970a-410c-4375-966a-d53c65dfafb8",
            "value": "549ec32545e0accc26ec168a4832efcbff729c3c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232936",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c59dde97-cb32-4704-b2cf-70414f2bb092",
            "value": "1f4c70cb317ffd25adc828fbac3bb8f07739e23111f7b7905926489fe35f8973",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232044",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9721679e-bbf0-4297-b045-c9c9b94f9f3d",
            "value": "98304:rao3ZgqdjaP2cscXJ5IwJH0S3J5k1dgZmRBuZ2pjQQC8/xLn+VAOfZeKGjQjIQaz:0oauMXJ5vZm/guQXse0XZlXr6xqr5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232044",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0b475268-c712-4910-951b-64937667bb14",
            "value": "9660840"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232044",
            "to_ids": true,
            "type": "filename",
            "uuid": "70899204-8788-43da-ba1c-e5caf4583c4c",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232044",
            "to_ids": false,
            "type": "text",
            "uuid": "fa07746e-ff33-418b-83a5-2c5411280351",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-04-25T23:14:44.000000+00:00\nLast Submission:2026-04-25T23:14:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235675",
        "uuid": "a8617a41-13d7-4820-af4c-796ab6e92d35",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235675",
            "to_ids": true,
            "type": "md5",
            "uuid": "45cb8dda-6b6b-48ef-9bcc-4a8bfa71ffbd",
            "value": "78a1a18f78ebe666a82f22f54a9e2330",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232937",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6ce39d5f-cee5-4e64-959a-a87a59680eb4",
            "value": "153f0af2340a959ec0f431b795a979f48d5f712b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232937",
            "to_ids": true,
            "type": "sha256",
            "uuid": "05156817-1cdf-48da-ab93-4341ea5803ab",
            "value": "ed036356fa2d3490d3ddb5ee7ae98bab80b505938f0199d9b10f12266f345896",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232067",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4e65057a-d068-48b4-bf92-6214307ef2d6",
            "value": "196608:VFe0xGirRWrJ1dS/LhToSluMRckqakgbhwM+G9JA/bVis8EAz4TC7T1QhQQLC/iC:V0BirR8G/Lh0onkSwzH8ZdclC/Kpxfmh"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232067",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4431c693-8a70-4384-96ec-cfe0fa86ec3f",
            "value": "14936333"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232067",
            "to_ids": true,
            "type": "filename",
            "uuid": "cc7b9b3e-92d7-4dd4-8cee-25df3feacb07",
            "value": "TikTok18_948.3.71.192.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232067",
            "to_ids": false,
            "type": "text",
            "uuid": "4f4433bf-7295-4dea-af84-6339ba45259a",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-05-15T10:43:18.000000+00:00\nLast Submission:2026-05-15T10:43:18.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235696",
        "uuid": "f3b64166-2444-435e-939a-941fbac128df",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235696",
            "to_ids": true,
            "type": "md5",
            "uuid": "ed5a90e3-6b23-4ea6-bbba-15ff6c75b8f8",
            "value": "791ead6b2a562f777d70e594bbd86b52",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232938",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3b86deca-54e3-4f85-b01c-de2b8a02a07b",
            "value": "886e568e4189d2f4ad912db54af82b1b6870f3a7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232938",
            "to_ids": true,
            "type": "sha256",
            "uuid": "71f713d7-7d83-4147-b82c-709544d8eec1",
            "value": "be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232089",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6f103f68-deb4-435f-9ce2-1cf1db44b155",
            "value": "98304:OZ3eNoU10SmZqVtTcpkK4EYr5eFmG1BSjbo3ANyLbD8ciFvPEo//3drmy0Tts6ya:JaUXmKwOaFmqBoPeobdrqTK9a"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232089",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b609c52c-8ce4-4a83-92e4-9f43cbce43fd",
            "value": "10682971"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232089",
            "to_ids": true,
            "type": "filename",
            "uuid": "53633584-c1c4-4736-9eef-a09356a4cb6c",
            "value": "be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232089",
            "to_ids": false,
            "type": "text",
            "uuid": "f86c6984-1095-4e38-9b04-25731140204f",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:18/65\nFirst Submission:2026-04-17T15:17:03.000000+00:00\nLast Submission:2026-06-19T22:56:49.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235717",
        "uuid": "93217792-35ce-49ac-bb95-ce5c825a89ee",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235717",
            "to_ids": true,
            "type": "md5",
            "uuid": "d3d6b6bc-62da-42b9-9c37-2d40784c78bc",
            "value": "86f30770dd116c9da42098f11f84ac46",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232939",
            "to_ids": true,
            "type": "sha1",
            "uuid": "99019b1b-e64e-4387-a5c9-533225fab4e3",
            "value": "9650ee6d3d7eca38952cb2e6a264e0d6d5c63a76",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232939",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a4220327-24a9-4c37-9ba0-03afc9e4e484",
            "value": "3c304a1ac73590aaf94b62711a5f2fd0cbb863dab13aef6ec1eb156f4a7bd5b9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232112",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "93789039-348b-4f9c-acc4-c9e28b1c198d",
            "value": "98304:Jo3hlVjgMiLmGBRGCzG9rQ+4zZYxYk0y/PSb6OWdT0QdJV0SO19f00H1sayjYE56:8dwBzZYxH0UsmT0eOgRauvI+wgG"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232112",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0f7550b3-8997-4b69-90f9-068adfc08ab9",
            "value": "10971041"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232112",
            "to_ids": true,
            "type": "filename",
            "uuid": "61e4f966-4f22-47a5-afca-ac7eeb4bb201",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232112",
            "to_ids": false,
            "type": "text",
            "uuid": "4c225b49-a322-44f5-86da-22ce317f1483",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-04-28T20:25:36.000000+00:00\nLast Submission:2026-04-28T20:25:36.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235739",
        "uuid": "9048bbea-9a73-4522-ab6b-8b8e7a7e255a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235739",
            "to_ids": true,
            "type": "md5",
            "uuid": "5d2d14c3-db88-4c01-85d1-982e1db3617d",
            "value": "8f92be9f524a636904721c2af49abb97",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232941",
            "to_ids": true,
            "type": "sha1",
            "uuid": "766b7d86-5447-4fa3-996b-576da866f7fc",
            "value": "1dea2add161006bae979e542fc551fcfca1fc0aa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232941",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e3f30024-f9ab-4dc6-8f85-1efc96062028",
            "value": "1ba364113c4cec5542d1b2c76d7c163a66bdf90bc373256d5178f880f9742960",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232134",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a8b526ea-372f-47fc-99c6-8d04eff403b3",
            "value": "196608:Qr7zKMYM+dzNgWnc9OSNg+vl8ZRDpD4sjn7gqCDCYTIpIjX8xH/LaYglPkPu2ql:RMYBGWc9/Zvi1DLj7xVYTIpIazajyuTl"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232134",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fa2620a0-495e-40cd-b077-28c1886b377c",
            "value": "13919425"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232134",
            "to_ids": true,
            "type": "filename",
            "uuid": "98790d3c-fe76-4559-a3f8-26e5a69d3db6",
            "value": "TikTok18_601.0.3237.891.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232134",
            "to_ids": false,
            "type": "text",
            "uuid": "8c2fe026-38fa-4fd1-a74d-14345327c753",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:13/64\nFirst Submission:2026-04-22T16:04:26.000000+00:00\nLast Submission:2026-04-22T16:04:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235760",
        "uuid": "127743b8-2c95-4b6e-a661-34305f3d6250",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235760",
            "to_ids": true,
            "type": "md5",
            "uuid": "4c0f425d-3318-4bee-9a50-0f5cb5ab7ce5",
            "value": "960eaa15382138938020c2e9907208bb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232942",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2a1cd0f8-eed2-40df-b975-b1a043f943d7",
            "value": "b4512e7d743e3597f975ae47ca87a4afd5b3cb53",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232942",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8e3dd170-a918-4e74-b44d-d4bd9277369a",
            "value": "2eb80e5519fc6defcec8cc30a5cf4f75ee5ec8d2435759bb77c19826f1e20efb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232157",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "da9439eb-2afe-4a1c-adfc-7eaaa84e4c3f",
            "value": "196608:5bm1/sELwLdzDf3PUXF1YfhaHNj7Z+IEiTtpNh7ge+TQX+ZQZYuqLTnkWn6xzdDn:9VELUxb3ueg1BE2tpNt/Y77Ln6Jdn"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232157",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8df39829-b9c5-4fa9-9d79-5fd9a3e9d62f",
            "value": "12467163"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232157",
            "to_ids": true,
            "type": "filename",
            "uuid": "492fe948-0a36-4ad5-ae8d-d37507010459",
            "value": "GoogleChrome25.04.2.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232157",
            "to_ids": false,
            "type": "text",
            "uuid": "05b2f3a8-b0d6-477c-8c4e-a59350df3ba8",
            "value": "Type Description: Android\nMicrosoft: Trojan:AndroidOS/Multiverze!rfn\nVT Total Detection:17/64\nFirst Submission:2026-04-27T15:28:14.000000+00:00\nLast Submission:2026-04-27T15:28:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235783",
        "uuid": "414b1ace-6039-4568-b94b-77311571fc2b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235783",
            "to_ids": true,
            "type": "md5",
            "uuid": "2f84a7df-ce0f-4fe1-b96c-b7a985fb02f6",
            "value": "9a53a27511314d7f9571ce0eb7619f70",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232943",
            "to_ids": true,
            "type": "sha1",
            "uuid": "275db911-fcf1-4127-92c3-df13b6e6a3f3",
            "value": "2658de23293a03bd077d46d75dfc83bca9525d29",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232944",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c006c1c4-ff37-450a-9175-5652dc953391",
            "value": "57307ee8a3cda10730eacecaf789fab6f8771f9d29397e07c31a6bd4551bba10",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232179",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "58cc79b4-b73f-4e4e-ae1e-30fffe99fd0a",
            "value": "196608:zpnE/9lzMU/US0dAtrym11JAQmg/OK0u5YzwkcJRWk7XrmCOjqrnBLphj:z6zV0dqJWQPNYARWkTrmCaqNpF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232179",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7591a201-b824-4f0f-adb0-6bf6fe606f77",
            "value": "13316636"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232179",
            "to_ids": true,
            "type": "filename",
            "uuid": "afe14dfe-b838-4f96-89eb-926dfc02cc3d",
            "value": "TikTok18_230.2.6665.86.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232179",
            "to_ids": false,
            "type": "text",
            "uuid": "81f5e9be-0714-4ff2-b4ed-ae4b65586c2d",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:14/64\nFirst Submission:2026-04-21T17:23:19.000000+00:00\nLast Submission:2026-04-21T17:23:19.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235804",
        "uuid": "34be3bd8-f134-4683-8924-9dc1ffe8bc57",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235804",
            "to_ids": true,
            "type": "md5",
            "uuid": "572badac-5c0c-43b4-b76b-d19146443dfc",
            "value": "9d613c4da12345202913d67e6692c1b7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232945",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6b737d50-15f4-4ab6-a23c-92973118173a",
            "value": "2897379c58f6971e38d4717caf323b6ed9da7fd5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232945",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b549e7c9-5d31-4525-8fa3-11e195452aca",
            "value": "696ef29f77a91aa91279c83088a07ab137d5049dc096ef862a35f9d890a552b3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232202",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f11b3732-11e6-4d4e-9716-edb0de47a182",
            "value": "393216:XXK5vjcP9XTsTFDzCkYTsluBB7RKJ5U+pDZHJl:qhj0XK930gI7kJ5UuZj"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232202",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4e397f5f-d5c9-4cff-8f80-92186d466c68",
            "value": "13718540"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232202",
            "to_ids": true,
            "type": "filename",
            "uuid": "e6bc2a6f-7796-4e6b-acf0-d13ed1e9036c",
            "value": "TikTok18_457.1.9798.645.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  19/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232202",
            "to_ids": false,
            "type": "text",
            "uuid": "c1bcf5d7-06f6-45c2-950a-7acefe32d60d",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2026-05-12T15:11:44.000000+00:00\nLast Submission:2026-05-12T15:11:44.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235825",
        "uuid": "db3d204b-63dc-4a87-9349-1bc546b260a0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235825",
            "to_ids": true,
            "type": "md5",
            "uuid": "f7a58432-887c-4877-b39e-1f16034df53b",
            "value": "a9127719338a0f4124660d1c90a03a5c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232946",
            "to_ids": true,
            "type": "sha1",
            "uuid": "498c2455-3d50-4ba7-bd8c-9473a84d82e4",
            "value": "68cc04a6f8b8f8f602b58acc28a1d170fa653b0c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232946",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8f7ae9b9-a172-4c62-ad0c-2f1e69ebe330",
            "value": "3fae7ede2ef9c809b54504c3d78e5111d7fad0b522c707b8f6ff21015af79251",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232226",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "43351613-f989-4890-9362-f0562653ad2c",
            "value": "196608:0/l8Ghc9CHwSJu3P/dp+Gs2n0eNrVWtqk2txn:0//xgSGdpWup"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232226",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7ffcb547-7842-4ced-8460-86a0ff677d97",
            "value": "10515337"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232226",
            "to_ids": true,
            "type": "filename",
            "uuid": "7f2bcc82-0116-4da2-aab8-78302e17a15a",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232226",
            "to_ids": false,
            "type": "text",
            "uuid": "d7bc2bf0-3132-4f84-a588-4d45832731c5",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2026-04-23T18:32:45.000000+00:00\nLast Submission:2026-04-23T18:32:45.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235847",
        "uuid": "81ac8583-54e0-429b-aec4-2069b7e5e9a7",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235847",
            "to_ids": true,
            "type": "md5",
            "uuid": "9691bf01-cfc5-4e91-b28e-188d52305428",
            "value": "b0833c924d43001be3e4534fa3e3d727",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232947",
            "to_ids": true,
            "type": "sha1",
            "uuid": "257e7c12-93d0-4296-b827-639ddb4675ed",
            "value": "e8daa78dca3287b2dd5ebb2ad1c202e869d1eed9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232947",
            "to_ids": true,
            "type": "sha256",
            "uuid": "8459d89b-4650-43ff-81f6-b33b4c38ac1f",
            "value": "c734a665f04eb9ab17047e65940fc35bad0221d59c2fc4fd0d170f2181514034",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232249",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0ced534b-89ba-4fcc-a53f-9dde4829458b",
            "value": "98304:YTKo3VC0kmkMPGNYzzeonplTYJEHVcLNMKdZ4IlX6VBLs3Pb5f7xQYc5E0SK7Ku2:VuPCYtnplXGLFZ4Iyo7xQLQK+u2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232249",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d4ca0b23-6c37-41c5-b313-243ed1b68e63",
            "value": "9144893"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232249",
            "to_ids": true,
            "type": "filename",
            "uuid": "9a1e10c2-3e21-4814-b635-20ea563cff05",
            "value": "p38yl8j.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232249",
            "to_ids": false,
            "type": "text",
            "uuid": "665907cf-f9a8-431d-9cbb-5995fa0707b3",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/64\nFirst Submission:2026-05-07T19:55:39.000000+00:00\nLast Submission:2026-05-07T19:55:39.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235870",
        "uuid": "49c4a199-c729-4711-a63c-099c4f61583c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235870",
            "to_ids": true,
            "type": "md5",
            "uuid": "9caf6aef-a1e6-4fa7-9105-f830d98fd3c6",
            "value": "c0bfc715aa0b6f9ff41fe5f22ade0c76",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232948",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e81ba282-e143-4f3c-8269-a1bb71e8fd75",
            "value": "017923d2295bf92a9c1731c7457978b3f900f4cb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232949",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1c6cee8b-a93a-4125-a23b-96e253649c91",
            "value": "8ddbcebe1014a645855986e85b2c54ee167baf1e9a0d74179faf81a5ee6878f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232271",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e71f7d52-7840-4f60-9385-ce6f300cadfd",
            "value": "196608:jKZFI0+alGAU3tbnTHfa11k/UITuqS+JwjORKAXtCPlan/QLHq1:WZKJTHwGtwKRK5Plan/0c"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232271",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "39fb3d64-f050-4db9-af6a-3e4dff75b8cf",
            "value": "11558105"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232271",
            "to_ids": true,
            "type": "filename",
            "uuid": "2f7c398a-b4ce-4e55-a8d4-5f07e46d5b73",
            "value": "GoogleChrome05.24.3.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232271",
            "to_ids": false,
            "type": "text",
            "uuid": "08b193d9-dd3c-471e-9102-4c1b93c17159",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:11/64\nFirst Submission:2026-05-24T18:31:14.000000+00:00\nLast Submission:2026-05-24T18:31:14.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235894",
        "uuid": "49e559d5-90fe-4cbc-a53a-cbba791e5935",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235894",
            "to_ids": true,
            "type": "md5",
            "uuid": "0d739138-cba4-44ab-8991-85678ea785b4",
            "value": "dc2bec284f293d1a58f8c8a02d4e6c85",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232950",
            "to_ids": true,
            "type": "sha1",
            "uuid": "44f9bf6f-5bc8-47d3-971b-84a5a208c33b",
            "value": "7e98337538437c4ab99105ae2e31d776d9c21590",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232950",
            "to_ids": true,
            "type": "sha256",
            "uuid": "caf84cfb-2324-498b-97ae-8298a9d6b0a7",
            "value": "1d3270a9141f8f16047799f1132633d72fd421b6c8f1878b5ef04ced6add4db8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232294",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f59240f9-3b77-49d3-a1b1-049b5c2b61a0",
            "value": "98304:RIwJBo30yH4+4OiyjbdLVKM2lez+j++YdKySwOE6LNH0S1HFmB1zSE9vf+htRPL3:RH1OiqRLVKVRj+ndcXzmBpSD3RPLTj"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232294",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ae0f4d18-e445-4603-8f50-83969a77e143",
            "value": "10599341"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232294",
            "to_ids": true,
            "type": "filename",
            "uuid": "57e7de54-136e-4c6a-a346-8816eb3351fd",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232294",
            "to_ids": false,
            "type": "text",
            "uuid": "52b6379d-1042-49f7-b505-ca6dba05303c",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:13/64\nFirst Submission:2026-04-27T13:53:32.000000+00:00\nLast Submission:2026-04-27T13:53:32.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235915",
        "uuid": "2172035e-076f-4f01-a5a1-bbc5ada65c74",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235915",
            "to_ids": true,
            "type": "md5",
            "uuid": "dd362c05-7a89-45fb-946d-1b93c7fc7390",
            "value": "e07e1ec214564d12c2f5aea847138232",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232951",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0d9a34c8-6dcf-4538-b8d5-83e16965181d",
            "value": "7a2b4acbfa9d4907c0681e880977e8cdfb26ae62",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232951",
            "to_ids": true,
            "type": "sha256",
            "uuid": "78ca1cda-d56b-4ed6-b577-803bb634e313",
            "value": "f0c18f045e3bb0193ef1169f5fa1abff7aa47e9a23da35cf67bbb9548a5e32c0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232316",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5c22545b-3682-4e45-aa41-421bd5f244e7",
            "value": "196608:GuUQ2mpsbbMYczLTLqbFDc5l/8VoKFEOF6+dWDWo14oYkVY2U9dE/ll/d2:GnQvxY8Lf+olfKFEOFjWDV14oYkVLU0U"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232316",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "29b45b95-2a56-4456-bfb9-37dd5fdec685",
            "value": "11565935"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232316",
            "to_ids": true,
            "type": "filename",
            "uuid": "91e4ed1e-e639-46c4-b224-777044f49971",
            "value": "GoogleChrome05.06.1.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232316",
            "to_ids": false,
            "type": "text",
            "uuid": "679c691d-e16b-40de-b59d-6e85836cc106",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/65\nFirst Submission:2026-05-06T21:08:38.000000+00:00\nLast Submission:2026-05-06T21:08:38.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235936",
        "uuid": "64479668-18e9-4616-b908-759500ee2c52",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235936",
            "to_ids": true,
            "type": "md5",
            "uuid": "ef0c9d54-5e6a-4528-9980-181998801007",
            "value": "e5ef5bc4ccae37c4d041afdaaca9a784",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232952",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e93f5c75-f27a-4c95-8326-b9f944e2c6eb",
            "value": "d781e4c217adec0d4f4e52ab70d747c2759cf968",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232952",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b1e0d736-b46b-491a-a347-2c279b7d62e4",
            "value": "d6403ec82659eb62424bb1033615a8df27635080d02e438a4ee7e2334b1155f7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232337",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8c15de6d-a1c0-4482-9fd9-65ee43e5b5b0",
            "value": "393216:gjqPCz57PJiispgQW5RBdnCSp5ms7eeU8n:gmPCFLgpwh9U8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232337",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c8d29007-07bd-455d-b227-e652553ac168",
            "value": "12723423"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232337",
            "to_ids": true,
            "type": "filename",
            "uuid": "b4075ead-cb16-422b-89a0-333d579dfc91",
            "value": "TikTok18_447.0.5021.371.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232337",
            "to_ids": false,
            "type": "text",
            "uuid": "07b8469a-1a38-4552-b3e1-2de73b0ef36b",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:15/64\nFirst Submission:2026-05-06T17:34:17.000000+00:00\nLast Submission:2026-05-08T14:09:46.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235957",
        "uuid": "2678c30f-2b9a-4111-8016-c727e468d0b9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235957",
            "to_ids": true,
            "type": "md5",
            "uuid": "bef4da36-0d7b-484e-95d8-259b2f1f4bcc",
            "value": "fefec424a52e88ef72e707c1f401df01",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232953",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3405a4bd-c4ba-4d88-bb19-b4857ec21712",
            "value": "c1fa081d0cd62005f69018171ae0397c44230cc8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232953",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a715957f-59d9-4f44-8ba0-511d2e71ca6f",
            "value": "43888be8debbbd74012484d4e4f9a1c70c2ff3970e0bf499c9aebba9776930a1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232359",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6bf147a1-bb42-4d2e-8c7b-35a94f7f3731",
            "value": "98304:po3jJEIpyOlBZEgTfjdSYCw7aX6ZVMisWDYsoqViQdZ5Wu03Iqva2Oetn590Rvg9:NIrdThSYpagPZyIOa2O0gIS0EYTtP8k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232359",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "18e78ce6-f548-4e5f-952d-41384244cd79",
            "value": "11049319"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232359",
            "to_ids": true,
            "type": "filename",
            "uuid": "651989f1-abf9-4701-98b7-3e733c7c0c41",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232359",
            "to_ids": false,
            "type": "text",
            "uuid": "bbccccb3-1d09-428d-b204-e39c15072d89",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2026-04-26T14:59:11.000000+00:00\nLast Submission:2026-04-26T14:59:11.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782235979",
        "uuid": "808909d7-beda-4708-ad01-6114ec7606c2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782235979",
            "to_ids": true,
            "type": "md5",
            "uuid": "02aa6a5a-4de0-441f-a4da-76f3a9903410",
            "value": "3b7c7b49995905ebe782422fb62d4eac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232954",
            "to_ids": true,
            "type": "sha1",
            "uuid": "30d1eafc-20d9-40ff-8b26-428b7de66145",
            "value": "cee59a5eff25596c16a2fa823676f75af086ed31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232955",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ffe92415-8961-4d63-b6d1-4cc8d219887b",
            "value": "5139253b1f30b34ab3aa888aba175866fa1f82728ab07b999c24b49b191c3f68",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232423",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1b97ce16-c209-4283-a458-ed92388c1847",
            "value": "196608:SLMSvIcAB9OLjJF4msi423aJBZa93xjOVAD9GiS1h3ZeiUGRFJlWf:qMVLUzWn2t9BjYAhEYvGNl+"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232423",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e4c637a3-e254-4ba9-b07f-202acdda7fd0",
            "value": "13877408"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232423",
            "to_ids": true,
            "type": "filename",
            "uuid": "f58f3626-b269-4d2b-9e1c-238b1930c4d1",
            "value": "TikTok18_459.6.8820.813.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232423",
            "to_ids": false,
            "type": "text",
            "uuid": "dcd762d0-af6c-4ceb-8fc8-a7ae9636db9e",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:15/64\nFirst Submission:2026-04-13T17:51:47.000000+00:00\nLast Submission:2026-04-13T17:51:47.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236000",
        "uuid": "43874cce-67a8-44c5-96e0-6c2e8f64c317",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236000",
            "to_ids": true,
            "type": "md5",
            "uuid": "d39bab64-eafb-4cfe-b958-cb0131719e1d",
            "value": "fa51ac4f87b945b7e577a160e2f58488",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232956",
            "to_ids": true,
            "type": "sha1",
            "uuid": "061f191f-959a-4c71-8480-a4b67a346b6e",
            "value": "6e3e242284da0e1905697525ff7eea73e7d300f8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232956",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7038d608-4ee7-4a62-90ff-93e8914838e8",
            "value": "5d0c5d8da8202f512339457ae00ed2d9b9c930cefc63fa5a28a049aba4127ab7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232444",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "dabf72e1-cdd2-44aa-aa66-0bf2184c0638",
            "value": "196608:RjX62TeAdGOHpSdMtsCtu03KPWKdUqvOsIiSlwCQ66vtodoJwULj5zFB/TRWsVj:9/T1d3EdSztStUqvOdwCB6Vyopt5P"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232444",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d38e4904-1ed2-4cc9-8d64-d7efc65e8b21",
            "value": "12624149"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232444",
            "to_ids": true,
            "type": "filename",
            "uuid": "6f4c8cd5-4ddd-4fc4-a214-aeab37c30404",
            "value": "TikTok18_489.bin"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232444",
            "to_ids": false,
            "type": "text",
            "uuid": "d0eccf29-a01b-425f-b449-94d6086bc1ce",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/64\nFirst Submission:2026-05-14T19:30:17.000000+00:00\nLast Submission:2026-05-26T15:08:57.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236021",
        "uuid": "f7969646-310b-425c-a6d3-aed49c4244fc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236021",
            "to_ids": true,
            "type": "md5",
            "uuid": "f791873f-76c6-467f-b18b-3dc014b5008d",
            "value": "7b64ca88e98dfb81989969e8a177648c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232957",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c1682d16-d8fe-4791-8d8b-62b44b0b0f5d",
            "value": "59d3c9edbd028a424b466c57c96c067f7530abd6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232957",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ae13f8ae-dd82-4199-99c6-66d05f9e953a",
            "value": "7aa389f25997610a96f014977eecd6d69142bdc63841e0d84976e3e621831303",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232466",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ba232fb7-409c-48da-874c-94e720057a72",
            "value": "393216:Om1CLacW9I55S3W/ZABMAJVhxz689u7kfl:g5Qm/ZNwhs7i"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232466",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4a507102-2111-469b-9532-9858ad37a4f3",
            "value": "12962246"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232466",
            "to_ids": true,
            "type": "filename",
            "uuid": "6861cbdc-681f-4e8f-acfa-ee98066566cd",
            "value": "Dropper.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232466",
            "to_ids": false,
            "type": "text",
            "uuid": "f4532d84-96d5-490a-8534-3f6364be181f",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:15/65\nFirst Submission:2026-04-12T23:44:34.000000+00:00\nLast Submission:2026-05-15T12:59:53.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236042",
        "uuid": "75be07b1-3bc6-4cac-9ac3-fb708a550f9b",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236042",
            "to_ids": true,
            "type": "md5",
            "uuid": "88b4cba8-bc4d-4fcb-ae26-f0a4dda85378",
            "value": "1e2812e17d950099c496b7c756b5abbc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232958",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4503a911-a210-4e06-a650-bf8c13c45d51",
            "value": "1e64ec113364e37d7a95976dd611779058580994",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232958",
            "to_ids": true,
            "type": "sha256",
            "uuid": "517e3854-9e41-41b7-9907-22b03c5ffe73",
            "value": "890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232488",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0f8f0c43-4a11-4898-9370-5504b22819ba",
            "value": "196608:6sGvZeY8juQgY9/XzKk47nKoBSRuJMC4WPsUl111QlCO/y2:dY8juQtKDBJJMCVsU7PQlfy2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232488",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "512c7de4-2a06-48ce-8851-7d8102b73808",
            "value": "13640895"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232488",
            "to_ids": true,
            "type": "filename",
            "uuid": "c619e977-a489-4c90-8279-6f751a083250",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232488",
            "to_ids": false,
            "type": "text",
            "uuid": "fafc2697-b1f0-402a-a2bd-ceaa8a1b3d00",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/64\nFirst Submission:2026-02-20T04:17:32.000000+00:00\nLast Submission:2026-02-20T04:17:32.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236064",
        "uuid": "1eab9eef-7e18-4970-9209-e36a1bf95e25",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236064",
            "to_ids": true,
            "type": "md5",
            "uuid": "7499b305-a9ca-471a-a0c3-1e2d65843dc0",
            "value": "b580885b96159f19525c2d51a302c6f5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232960",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2755fdf6-3224-4b97-b68b-0cb8483171ee",
            "value": "b7ce0541efe9ec5da57f690de484cb40d1035f60",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232960",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e3b4f221-077a-4a53-a3cc-2d9a5bc8dcb6",
            "value": "c08cd3f78c0edcced6b1a694284b6ed4a9e0422f469e07c702c4a8d1f6c186f4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232551",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "35bce46e-ca5f-4cc1-a4ed-8c7a24c9606b",
            "value": "196608:bclZpq61Q5K7AsZphNKfHdcM19qBKba13VA:wrpdYKflKyMkbe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232551",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4ccba91a-56b8-4b60-ae3f-4b01676b360f",
            "value": "11320232"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232551",
            "to_ids": true,
            "type": "filename",
            "uuid": "3a4a2813-6054-483c-8257-335f733ab325",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232551",
            "to_ids": false,
            "type": "text",
            "uuid": "faf27d76-733b-4065-8d75-7da8748df7c4",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:14/64\nFirst Submission:2026-05-22T22:45:38.000000+00:00\nLast Submission:2026-05-22T22:45:38.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236085",
        "uuid": "53b7d511-5028-4a88-acd3-8dbdf0c03b8a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236085",
            "to_ids": true,
            "type": "md5",
            "uuid": "1abf932f-ef1f-4daa-a73f-f9a14db4f992",
            "value": "33ac63bad8bff64c9a7618be2643c61b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232961",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d37306db-a185-476c-9c47-ee312dc5aff4",
            "value": "30af3eb0bafe9f705ac6bbc3f94dae4143056a6b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232961",
            "to_ids": true,
            "type": "sha256",
            "uuid": "324314ba-9fa7-4059-9fe7-de53f5fbcf12",
            "value": "c3cfe522d2da15b033f65eb5377bf9e99be598dc4c21729e6f168dbc8f19540b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232573",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "93ae96a0-54de-4432-bb95-e325885193b3",
            "value": "196608:eGMsZaiXzXgPsdpNN+m4l+0K/LiqVRV8slb/MnHyVeP7F3vIkLXp2Un0o7AbeEYK:G4aSEEXNFI2EobkH15Xp2+vAbeMZ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232573",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2d454f54-6fa4-40b3-ad9c-ff7eb1f24bd5",
            "value": "12777200"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232573",
            "to_ids": true,
            "type": "filename",
            "uuid": "0cc73192-74b7-42dc-9b8d-faad0f775af3",
            "value": "a9p9ey.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  19/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232573",
            "to_ids": false,
            "type": "text",
            "uuid": "a6c841e6-b652-4b3b-bfd3-f1e9d78500d2",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/65\nFirst Submission:2026-05-21T20:14:41.000000+00:00\nLast Submission:2026-05-21T20:14:41.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236106",
        "uuid": "c21d7a00-938b-4e29-8927-1a6f36af53db",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236106",
            "to_ids": true,
            "type": "md5",
            "uuid": "c70ce6f8-6670-4078-86a7-494b5592bcf3",
            "value": "1f25c3d44edafe554172bbb7a751f341",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232962",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d4ba18b7-9ff6-433f-accf-bd5e06ce76dd",
            "value": "342775950569f42e34c9433650874993b24e4a8e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232962",
            "to_ids": true,
            "type": "sha256",
            "uuid": "118f40a1-4e8e-4d13-9cf3-982eb11bdbc3",
            "value": "c3e324106803df27f5b6e0d49d2daf02d4cde396af4401f1ad29d78198e370b6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232595",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "be05149d-ca7d-4be6-9a89-89a58ae36c16",
            "value": "196608:cVqk/PY7AX92JUBLjzNV4ES0JfKCUZ0HgQ6sI:oVPY7O9/BHz0UJ+ZtsI"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232595",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "88ce280d-423b-4388-b886-b622b312740f",
            "value": "12664955"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232595",
            "to_ids": true,
            "type": "filename",
            "uuid": "96c891aa-0e4f-4bb7-a8bc-9ff796c9143a",
            "value": "update.apk"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232595",
            "to_ids": false,
            "type": "text",
            "uuid": "387583aa-36bc-4cfd-b539-9074efc9f1df",
            "value": "Type Description: Android\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:17/65\nFirst Submission:2026-05-27T03:47:03.000000+00:00\nLast Submission:2026-05-27T03:47:03.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782236130",
        "uuid": "0b4907cb-fe06-4f4d-99da-f7ae730e5beb",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782236130",
            "to_ids": true,
            "type": "md5",
            "uuid": "fdff60e8-d697-48c7-ae1d-080a387c91ed",
            "value": "a1adb2374ea2c7cbc678bc8066cb509f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232964",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ec372dc1-032c-4ab0-86e1-23cbfe09075b",
            "value": "cafb1e8df9a46a03a6d76e0d11c4c8db7652850d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232964",
            "to_ids": true,
            "type": "sha256",
            "uuid": "afec9951-6b0e-4745-b284-a3218d6db571",
            "value": "f49be77b95cabd28d2dfe91786863576f6bd3f43a9d6de67a5b5851afe3aff9a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782232659",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2fb53f22-c9e6-4583-abb1-82cfd9c1e632",
            "value": "98304:M7oo3srgaYDyxRfxM0SK36a1W/dkuFT/6bExJ3h+2+bVdQEQL+HJb5phJjWcVlQU:iSCDznz/dHhSq+DQBLG9jWcJ9mblYg+"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782232659",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "b0210fc4-678f-4aa8-b28e-ae38926d6f25",
            "value": "12959789"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782232659",
            "to_ids": true,
            "type": "filename",
            "uuid": "2711c727-7e3e-4e7b-adba-56f473472182",
            "value": "ki4gvgmr1.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  19/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782232659",
            "to_ids": false,
            "type": "text",
            "uuid": "44c97440-bb63-437d-a86b-35a259dbda4e",
            "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/65\nFirst Submission:2026-05-27T15:27:13.000000+00:00\nLast Submission:2026-05-27T15:27:13.000000+00:00"
          }
        ]
      }
    ]
  }
}