{
  "Event": {
    "analysis": "1",
    "date": "2026-06-15",
    "extends_uuid": "",
    "info": "[Threat Intel] The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed",
    "protected": false,
    "publish_timestamp": "1782253794",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782253794",
    "uuid": "d5715164-f8a4-40b1-b225-96ea7a71e85e",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#8f20d0",
        "local": false,
        "name": "misp-galaxy:producer=\"Huntress\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#db2044",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1598.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c59c9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Accounts - T1586.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#fd9f99",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mail Protocols - T1071.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#151103",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unused/Unsupported Cloud Regions - T1535\"",
        "relationship_type": ""
      },
      {
        "colour": "#06e9fb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Addresses - T1589.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#07a4a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#ad3992",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Server - T1584.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#ce59f1",
        "local": false,
        "name": "misp-galaxy:target-information=\"United Kingdom\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Bolivia\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578865",
        "to_ids": false,
        "type": "link",
        "uuid": "baf0d4ea-92a9-4c54-a1af-f6a49c91286a",
        "value": "https://www.huntress.com/blog/terminal-server-phishing-stager-exposed"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578865",
        "to_ids": false,
        "type": "text",
        "uuid": "fa9a2b95-0af0-4a97-8690-f527c750f5a6",
        "value": "On May 15, 2026, Huntress agents detected an intrusion where threat actors compromised a terminal server to stage a massive phishing campaign rather than deploy ransomware. The attacker used legitimate bulk email software (Gammadyne Mailer) with a project file named 'dracii' (Romanian for 'the devils') and six recipient lists containing 8,894,920 email addresses. Operating from Romanian IP addresses, the actor impersonated UK pharmacy chain Boots through a fake customer satisfaction survey designed to harvest personal and payment card data. The phishing kit was hosted on a compromised Bolivian government website (ipelc.gob.bo), which Huntress reported to Bolivia's national CSIRT. The campaign used direct-to-MX delivery to bypass mail relays, with the mailer configured to send from 666 threads simultaneously. Evidence suggests this Romanian operator has been running multiple UK-targeting campaigns since at least July 2025, rotating between retail, tax, and cryptocurrency themes."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578865",
        "to_ids": false,
        "type": "text",
        "uuid": "5ab6cc95-5a17-47ec-ab3e-c43c2920f673",
        "value": "Name: The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed\nAuthor: AlienVault\nAdversary: \nTags: [\"phishing campaign\", \"credential theft\", \"romanian threat actor\", \"rdweb portal\", \"payment card harvesting\", \"bulk email abuse\", \"terminal server compromise\", \"compromised government website\"]\nTgtd countries: [\"Bolivia, Plurinational State of\", \"United Kingdom of Great Britain and Northern Ireland\"]\nMlwr families: []\nAttack_ids: [\"T1133\", \"T1114\", \"T1566.002\", \"T1598.003\", \"T1586.002\", \"T1036\", \"T1185\", \"T1071.003\", \"T1535\", \"T1589.002\", \"T1090\", \"T1078\", \"T1027\", \"T1132\", \"T1189\", \"T1584.004\"]\nIndustries: [\"Retail\", \"Government\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233151",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "92ab6c73-f54a-4b35-9703-3ca6aa982c68",
        "value": "87.251.64.134",
        "Tag": [
          {
            "colour": "#0fadcd",
            "local": false,
            "name": "asn:asn=\"197414\"",
            "relationship_type": ""
          },
          {
            "colour": "#800fcb",
            "local": false,
            "name": "asn:as-owner=\"XHOST-INTERNET-SOLUTIONS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233173",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "41768fa0-0a87-4bcc-a5e6-8771090e4874",
        "value": "80.94.95.37",
        "Tag": [
          {
            "colour": "#17b4c6",
            "local": false,
            "name": "asn:asn=\"204428\"",
            "relationship_type": ""
          },
          {
            "colour": "#fa8885",
            "local": false,
            "name": "asn:as-owner=\"SS-NET\"",
            "relationship_type": ""
          },
          {
            "colour": "#059db5",
            "local": false,
            "name": "asn:as-country=\"BG\"",
            "relationship_type": ""
          },
          {
            "colour": "#390b5f",
            "local": false,
            "name": "misp-galaxy:country=\"bulgaria\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233194",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "35239884-9f0e-4fec-aa73-2aa5d979c632",
        "value": "216.152.151.168",
        "Tag": [
          {
            "colour": "#13e99a",
            "local": false,
            "name": "asn:asn=\"33154\"",
            "relationship_type": ""
          },
          {
            "colour": "#f012fe",
            "local": false,
            "name": "asn:as-owner=\"DQECOM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233215",
        "to_ids": true,
        "type": "url",
        "uuid": "d51b2976-1831-45f8-bfe9-dc7fbcd9a39b",
        "value": "https://ipelc.gob.bo/boots_store/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232875",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b75be545-9a97-44b6-bfdb-8bd5d3403be3",
        "value": "13ac78f8f2ed76a03c85f0cdef07e5463aa64458303c0949090fcd81868ba8ca",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232877",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4c77237a-8683-47a3-84d7-85abe233e4ba",
        "value": "375c2c84e2ca022c565507523b75c9c08a455479861ea41fc9b9ff74b3453445",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232877",
        "to_ids": true,
        "type": "sha256",
        "uuid": "f0f93dca-6fa0-4178-a033-8787662017bf",
        "value": "5d2ad1795b0dfc4a58424b2fa2f002246f653b119d362954ae270b6998e9d575",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232879",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56789666-c0a3-4515-96ef-da1fab918e4e",
        "value": "6c428acbd91be85fedf9cbb334457ddea08ff624d4de88041749578e968d62a8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232879",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e9d8e412-326d-4032-8ad3-af82655bb002",
        "value": "7fda5f10a2bc212daaa467484c56eb8abf3f3681f6405c5c2fac16d4124e44ca",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232880",
        "to_ids": true,
        "type": "sha256",
        "uuid": "6ba07f21-a805-4d9e-a922-5f7a6ecb5f0f",
        "value": "95fc58dc321b07ecc99d95359bcdee08a5beb519ead8e70e40f33928533a1b14",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:24/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782232881",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e2fa4aa5-cdb2-43b3-a3b0-8b9c62acc879",
        "value": "c5ec55270af084d3c07d2918098d598bc2c5ca42f4189d69cdfcae2c958e5ec7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233236",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b37421df-1d95-4bd1-9c6f-33ddd0af8eba",
        "value": "212.93.152.37",
        "Tag": [
          {
            "colour": "#c727cb",
            "local": false,
            "name": "asn:asn=\"8708\"",
            "relationship_type": ""
          },
          {
            "colour": "#48ecf6",
            "local": false,
            "name": "asn:as-owner=\"RCS-RDS 73-75 Dr. Staicovici\"",
            "relationship_type": ""
          },
          {
            "colour": "#26f3a1",
            "local": false,
            "name": "asn:as-country=\"RO\"",
            "relationship_type": ""
          },
          {
            "colour": "#026417",
            "local": false,
            "name": "misp-galaxy:country=\"romania\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233257",
        "to_ids": true,
        "type": "url",
        "uuid": "172e9486-7b82-4432-b8d4-9db33a3f0409",
        "value": "http://ipelc.gob.bo/boots_store/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233278",
        "to_ids": true,
        "type": "domain",
        "uuid": "cc8d5033-48a5-47fd-8d86-d5a1f3cfd307",
        "value": "boots-rewards-uk.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233299",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7e1678e1-b14d-4795-8e7d-7f478f762964",
        "value": "88.210.63.0/24",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing payload, hosted in a subdirectory of a compromised Bolivian government website",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233321",
        "to_ids": true,
        "type": "domain",
        "uuid": "ccfd9a80-e40d-4162-90d3-4e5e75262b07",
        "value": "gob.bo",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782134749",
        "to_ids": true,
        "type": "email-src",
        "uuid": "b59068af-c3d6-47d6-9a83-7da3308d8c28",
        "value": "lacafea77@outlook.com"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782233342",
        "uuid": "87e2ee7c-a7fa-4afb-9ab6-36ba911299a8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782233342",
            "to_ids": true,
            "type": "md5",
            "uuid": "0a812684-8070-49f3-bfb9-9567a0dba257",
            "value": "9b11371752cd39821e28df014f09dff8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782232874",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0b97d182-312e-450c-a9c0-d8d4385e891a",
            "value": "c4fdaf6f876e3ad7d2aee32b2ac9f9f20d3f9145",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782232874",
            "to_ids": true,
            "type": "sha256",
            "uuid": "dd0a6e89-81cb-49cb-810a-abb84651f035",
            "value": "dc8a31a104df44b76a05c3e6d4fbe85be243cc6db0ff25e298e25cc469715046",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782231032",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "20ec724f-3b46-4e10-a886-5e370d5e1a4e",
            "value": "393216:/L3xbzv0t+p4TDN89Z0rD6IcH4MAcjsy9+iMO1Clje:D3xbzv0t+p4TDN89Z0rD6rH44syQVe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782231032",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2c1f2c9c-23c7-4c0f-9b11-23081539f5e0",
            "value": "15331224"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782231032",
            "to_ids": true,
            "type": "vhash",
            "uuid": "007e3a44-de4a-406a-a08c-2928f874d4ba",
            "value": "017076656d551d155571c1z5075700c87zc095za0100743z11a7z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782231032",
            "to_ids": true,
            "type": "filename",
            "uuid": "99aea99c-19ab-49b1-85f3-034db8d94ac0",
            "value": "gm.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 24/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782231032",
            "to_ids": false,
            "type": "text",
            "uuid": "2f43fe31-25db-4961-b28f-819565e8881a",
            "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:2/70\nFirst Submission:2017-05-17T23:10:45.000000+00:00\nLast Submission:2025-07-15T10:00:51.000000+00:00"
          }
        ]
      }
    ]
  }
}