{
  "Event": {
    "analysis": "1",
    "date": "2026-06-20",
    "extends_uuid": "",
    "info": "[Threat Intel] ClickFix campaign delivers macOS infostealer via DMG",
    "protected": false,
    "publish_timestamp": "1782533504",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782533503",
    "uuid": "d4765266-2b06-4fef-857a-0c0304e7e296",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#256f6a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL - T1574.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#3909cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "relationship_type": ""
      },
      {
        "colour": "#838eb9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keychain - T1555.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#680082",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"MacOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442829",
        "to_ids": false,
        "type": "link",
        "uuid": "9025e654-f6f3-4a36-969e-9d0146f532e3",
        "value": "https://x.com/Unit42_Intel/status/2069321645924159505"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442829",
        "to_ids": false,
        "type": "link",
        "uuid": "1673a4c0-4d22-4c9b-9459-eee2670c17d9",
        "value": "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-06-20-ClickFix-campaign-delivers-macOS-infostealer-via-DMG.txt"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442829",
        "to_ids": false,
        "type": "text",
        "uuid": "a86e4a6b-6337-4134-98c9-64a9575ec256",
        "value": "A new macOS ClickFix campaign employs fake CAPTCHA pages to deceive users into executing malicious Terminal commands. The attack chain downloads and invisibly mounts a DMG file containing a self-signed information-stealer application bundle. This payload, assessed as belonging to the AMOS (Atomic macOS Stealer) lineage\u2014specifically the Odyssey variant\u2014prompts users for passwords through fake System Preferences dialogs. The stealer harvests extensive data including browser credentials, cryptocurrency wallet information from 13 standalone applications and 201 browser extensions, messaging app data, Apple Notes, Safari cookies, and macOS keychain entries. Exfiltrated data is compressed and sent to two command-and-control servers. The malware establishes persistence via LaunchAgent and trojanizes legitimate cryptocurrency applications including Ledger Live and Trezor Suite, replacing them with compromised versions downloaded from attacker infrastructure."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442829",
        "to_ids": false,
        "type": "text",
        "uuid": "cbe6ed0b-3c45-4103-8eee-36333aee759d",
        "value": "Name: ClickFix campaign delivers macOS infostealer via DMG\nAuthor: AlienVault\nAdversary: \nTags: [\"browser-theft\", \"atomic macos stealer\", \"clickfix\", \"macos\", \"credential-phishing\", \"amos\", \"odyssey\", \"infostealer\"]\nTgtd countries: []\nMlwr families: [\"AMOS\", \"Atomic macOS Stealer\", \"Odyssey\", \"NNApp\"]\nAttack_ids: [\"T1574.001\", \"T1027\", \"T1036.005\", \"T1119\", \"T1555.001\", \"T1005\", \"T1185\", \"T1204.002\", \"T1539\", \"T1566.002\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528688",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d379e259-b3ce-4b08-bdfb-90c33fa57b21",
        "value": "178.16.52.101",
        "Tag": [
          {
            "colour": "#ce048f",
            "local": false,
            "name": "asn:asn=\"209800\"",
            "relationship_type": ""
          },
          {
            "colour": "#434f78",
            "local": false,
            "name": "asn:as-owner=\"METASPINNER-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528709",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1704c767-45d0-499a-b063-d0556f3f4e48",
        "value": "196.251.107.171",
        "Tag": [
          {
            "colour": "#9edafe",
            "local": false,
            "name": "asn:asn=\"9304\"",
            "relationship_type": ""
          },
          {
            "colour": "#26db00",
            "local": false,
            "name": "asn:as-owner=\"HUTCHISON-AS-AP HGC Global Communications Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528730",
        "to_ids": true,
        "type": "domain",
        "uuid": "0af3b651-2b81-4cfe-9077-0ce723a48f95",
        "value": "fewfwfwfwfwf.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528751",
        "to_ids": true,
        "type": "domain",
        "uuid": "514ef608-4bb9-447f-9efe-554cf5c0f0e5",
        "value": "svs-verificationdate.beer",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527976",
        "to_ids": true,
        "type": "sha256",
        "uuid": "36c1ebfa-8626-4250-8002-e658ba464a4a",
        "value": "8111edf01ac6cb5c77e249d4e84fd92a85b5e89c2e2bef92fbe00b6f1cc2aa8e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527977",
        "to_ids": true,
        "type": "sha256",
        "uuid": "f829eef0-e2a7-4a85-8f10-a200a8d714fd",
        "value": "f0038a5f46720da5982b6984ceef10cf99359432e102b12a0b0657498d36f670",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782445826",
        "to_ids": false,
        "type": "link",
        "uuid": "68334773-0431-4f71-afee-64beb648702b",
        "value": "https://www.linkedin.com/posts/the-latest-macos-clickfix-variant-invisibly-ugcPost-7475087272908996608-Txi8/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528773",
        "to_ids": true,
        "type": "url",
        "uuid": "412c22d6-c2e3-49e1-8f20-1cc85393bf0d",
        "value": "http://svs-verificationdate.beer/f0038a5f46720da5982b6984ceef10cf99359432e102b12a0b0657498d36f670",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528795",
        "to_ids": true,
        "type": "url",
        "uuid": "8d565b38-3478-4c37-84e3-fa4b414bdb30",
        "value": "https://fewfwfwfwfwf.info",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 3000",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528816",
        "to_ids": true,
        "type": "url",
        "uuid": "a44ddc82-4508-4787-ad2c-8fda0fbdfeec",
        "value": "http://196.251.107.171",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782528837",
        "uuid": "d2bbd8d9-40d7-43f5-9d42-944d510016a8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782528837",
            "to_ids": true,
            "type": "md5",
            "uuid": "dacb1494-ebcf-428d-9199-cb3cadc41f29",
            "value": "73c4f012d8db6e8d74f03dd8168c7945",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782527971",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c6cd58eb-4b05-4655-9b7f-9559d093790e",
            "value": "27b7c9137718fccce98773f9111e21754ebf73d3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782527972",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a3529a83-6e52-4f73-8d3e-14c031c93771",
            "value": "25b6fc4f9c54a28ba7bfc4dfeafb62c99b59ea6f0d17679219b876b321965095",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782525408",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "89b3c480-2b8b-4b2e-af5d-95af043dfd12",
            "value": "6144:tFIRhqO1ViVAj4Z4F1j2j0QnZzI/0O+IL4YCeWj1lzuS:tGBC9Z43ijnyMONcYAj1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782525408",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f5f224ff-9c9c-4aba-9761-c9e3e8426c09",
            "value": "533739"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782525408",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ecfed0f9-5703-4291-8fe2-c82d89efdff1",
            "value": "459abce72ba367415cf9175f942cd2c2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782525408",
            "to_ids": true,
            "type": "filename",
            "uuid": "e3ac0722-17c1-48fd-b979-3fbf3b94aaa8",
            "value": "com.utils.nnapp"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782525408",
            "to_ids": false,
            "type": "text",
            "uuid": "98ff80b6-6a80-422a-9445-9d83df4c1bb3",
            "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:Win32/Vigorf.A\nVT Total Detection:20/61\nFirst Submission:2026-06-13T23:05:06.000000+00:00\nLast Submission:2026-06-14T00:21:24.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782528858",
        "uuid": "4ef47bc5-7357-442c-886e-e471629bc0a2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782528858",
            "to_ids": true,
            "type": "md5",
            "uuid": "6e7083f3-c0fe-49b7-99a2-3f5e673af99f",
            "value": "47cbe91e2966986bb24b14642083afa9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782527973",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d98aa257-6e69-4780-b6ea-2fb10e48b2b3",
            "value": "a0c43b04b56c2140a4704237a86321a0cdeb688c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782527973",
            "to_ids": true,
            "type": "sha256",
            "uuid": "ab313838-eff7-4abf-96fd-4ddf1c2c257f",
            "value": "067ad6221b2224d5cdb64e51c5516132d820cf4d7edf9ec170643943e79c04b7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782525430",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5b6ae4db-1d58-4a26-a17b-c8e1dda7bba5",
            "value": "12288:bUoLDfDCf5ATJthqgQZcotxO4yeZQYLEeulVkc/Z1uP:bUoLvCKTCt1IVkcg"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782525430",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "851c0ac1-95aa-46da-940a-fa47a7e1b772",
            "value": "723072"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782525430",
            "to_ids": true,
            "type": "vhash",
            "uuid": "39920fa5-1534-4c82-8288-746c33ab2dc1",
            "value": "0252dc858045d41516d6efd67b758612"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782525430",
            "to_ids": true,
            "type": "filename",
            "uuid": "25f12f7d-8733-4fba-8de8-5640c52c2cd9",
            "value": "com.utils.nnapp"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782525430",
            "to_ids": false,
            "type": "text",
            "uuid": "0a2eb0a3-6f0f-4807-b28a-b4d10a374851",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/AmosStealer.DB!MTB\nVT Total Detection:33/63\nFirst Submission:2026-06-14T22:51:30.000000+00:00\nLast Submission:2026-06-14T22:51:30.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782528879",
        "uuid": "0fc26787-8615-49d1-8ec2-1dbe4b27e377",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782528879",
            "to_ids": true,
            "type": "md5",
            "uuid": "5c56772c-0e0e-4450-9346-592791eb5923",
            "value": "9f0867f1106026061cdaad423ada079c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782527974",
            "to_ids": true,
            "type": "sha1",
            "uuid": "75faf67e-da44-4574-ae80-95439aeb5c25",
            "value": "f3b2864ac5ec1d3c7e6f9af4bd00dd756012c730",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782527974",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c6c670d3-49de-4bc7-80b4-0b1c16ffa736",
            "value": "d6f479736ba55d3c4e895c4940d035cf772f3192fb8dc496f09a801aed16d970",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782525452",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2c49235a-07a2-40d3-86e1-ac9438e54dc7",
            "value": "6144:2LQflMFGo73MpgfDCSFU6v3x6I45ATKWtkcqURQZcwRtxDChqyEn96:2UoLDfDCf5ATJthqgQZcotxO4y"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782525452",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9c8120b2-978e-417a-9ff1-5b10a8301976",
            "value": "342624"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782525452",
            "to_ids": true,
            "type": "vhash",
            "uuid": "90f714a3-a6a4-464c-821a-0601d1aece84",
            "value": "b8e8cf639a8c7cd2068d69e18f5322ce"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782525452",
            "to_ids": true,
            "type": "filename",
            "uuid": "ed6a0e5f-f38b-4ecd-b671-7c1e2a252c99",
            "value": "com.utils.nnapp"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782525452",
            "to_ids": false,
            "type": "text",
            "uuid": "7245268f-03ac-42d1-ab0c-c73d83671716",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/AmosStealer.DB!MTB\nVT Total Detection:32/63\nFirst Submission:2026-06-14T22:51:57.000000+00:00\nLast Submission:2026-06-14T22:51:57.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782528900",
        "uuid": "5fabf6e0-9127-43c2-b740-a124c03ad693",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782528900",
            "to_ids": true,
            "type": "md5",
            "uuid": "ed75a011-ab10-418e-ba4d-1ea243de7692",
            "value": "c8a3f22ab5f32c21126d2bde3d3e85ee",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782527976",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ff63003b-31be-4e6a-a371-b1338e467d2b",
            "value": "2212bc22fadb085265a8b304ebfc8fbf5ef4a873",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782527976",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c3a96db1-bf2a-45a6-9125-680ed5a56967",
            "value": "833008c03d40422192051584d829d730497108bef31751cceb0cc043dd96bbfb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782525474",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "82630636-2113-412d-9f40-295b065d6125",
            "value": "3072:BuI4fJ9+Fy8QjB28g0BlIjGMNosoPwPa1epPVW3o4808Fi4LenCnp3VkggkfdxQ7:wJ9dQiNeWEeulVkc/pr1U0clDvPhuu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782525474",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6188b56e-01cf-427d-abbc-9058e4294355",
            "value": "362624"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782525474",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c6d17c43-13ce-4674-b0e9-ae3e8ad987bc",
            "value": "519b64e88276631fff2b947cd6f5b9b0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782525474",
            "to_ids": true,
            "type": "filename",
            "uuid": "31e90ab8-5e40-4da2-8a4c-04cf3632a850",
            "value": "com.utils.nnapp"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782525474",
            "to_ids": false,
            "type": "text",
            "uuid": "b8077983-f547-4ac0-83a9-1f3a33c5afeb",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/AmosStealer.DB!MTB\nVT Total Detection:30/63\nFirst Submission:2026-06-14T22:51:57.000000+00:00\nLast Submission:2026-06-14T22:51:57.000000+00:00"
          }
        ]
      }
    ]
  }
}