{
  "Event": {
    "analysis": "1",
    "date": "2026-06-02",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor",
    "protected": false,
    "publish_timestamp": "1780521479",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780521479",
    "uuid": "df1ad879-c8fb-4b8e-b263-bee925461d92",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0afe32",
        "local": false,
        "name": "misp-galaxy:producer=\"Palo Alto\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#3bc6ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#029dd6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Extensions - T1176\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#680082",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"MacOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484406",
        "to_ids": false,
        "type": "link",
        "uuid": "cade16f6-c252-4f46-a1c9-58b578055d47",
        "value": "https://unit42.paloaltonetworks.com/flutterbridge-new-fluttershell-backdoor/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484406",
        "to_ids": false,
        "type": "text",
        "uuid": "fc15c2e7-3240-47d0-a4e9-6df53ff5031e",
        "value": "A financially-motivated cybercrime cluster designated CL-CRI-1089 has launched Operation FlutterBridge, deploying FlutterShell backdoor malware targeting macOS systems through malvertising. Built with the Flutter framework, FlutterShell masquerades as legitimate applications including podcast players and PDF viewers, delivering adware with full backdoor capabilities such as shell command execution and file system manipulation. The malware uses a WebView-based architecture with JavaScript-to-native bridge, allowing attackers to dynamically modify behavior without recompiling. Distribution occurs through hundreds of Google-verified advertisements controlled by shell companies including AdsParkPro LTD and Advantage Web Marketing LLC. The campaign primarily targets Anglophone and Western European markets. All samples were signed with valid Apple Developer IDs and successfully passed notarization, achieving zero detections on VirusTotal initially. The malware hijacks Google Chrome browsers, redirecting traffic ..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484406",
        "to_ids": false,
        "type": "text",
        "uuid": "a4d65721-4b9c-4400-bb3f-e7efeed65796",
        "value": "Name: Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor\nAuthor: AlienVault\nAdversary: CL-CRI-1089\nTags: [\"shell companies\", \"calendaromatic\", \"browser hijacking\", \"jscorerunner\", \"javascript bridge\", \"fluttershell\", \"recipelister\", \"macos\", \"flutterbridge\", \"google ads\", \"backdoor\"]\nTgtd countries: []\nMlwr families: [\"FlutterShell\", \"JSCoreRunner\", \"RecipeLister\", \"Calendaromatic\"]\nAttack_ids: [\"T1539\", \"T1553.002\", \"T1082\", \"T1176\", \"T1106\", \"T1005\", \"T1036\", \"T1185\", \"T1555.003\", \"T1083\", \"T1204\", \"T1041\", \"T1547.001\", \"T1566\", \"T1059.004\", \"T1027\", \"T1573\", \"T1543.001\", \"T1189\", \"T1071.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780484406",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "b0fde71c-4587-4ca9-aa0a-f7af07918df2",
        "value": "CL-CRI-1089"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501070",
        "to_ids": true,
        "type": "domain",
        "uuid": "09b74ae9-5c28-4160-b1be-82c9b7743313",
        "value": "atsheisdomestic.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501092",
        "to_ids": true,
        "type": "domain",
        "uuid": "bcd94ccd-045f-4389-b33e-3ac19d283c38",
        "value": "etoftheappyrince.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501113",
        "to_ids": true,
        "type": "domain",
        "uuid": "f923aafe-afeb-4289-9781-4ca40a145fd9",
        "value": "healightejustb.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501134",
        "to_ids": true,
        "type": "domain",
        "uuid": "8b44e1e4-b0f3-4585-afe5-69b607e5a910",
        "value": "sinterfumesco.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498075",
        "to_ids": true,
        "type": "sha256",
        "uuid": "91299b43-d728-49bc-a516-8f3260563c20",
        "value": "30448686ec900d5213d74f08f0d2b7924c5336a29445b2a434aba8d8b19d7530",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498076",
        "to_ids": true,
        "type": "sha256",
        "uuid": "8f4b1a4b-07c7-4297-801b-9c3d5c632863",
        "value": "48047c34bbd57fe1e24bc538bc2ce9e0ac4c4eb48d3b0c195b414f0379dc0745",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780498077",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b53c5943-81e7-4c09-babb-edb5932cbc94",
        "value": "9425e8e39fa8a7212cdd07f0917cb3dfde38a90b87297de2c82a5850aff1e4de",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501156",
        "to_ids": true,
        "type": "domain",
        "uuid": "4c6dc614-8eef-49f1-858f-4f9932fa4626",
        "value": "ads-parkpro.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501178",
        "to_ids": true,
        "type": "domain",
        "uuid": "25f1f347-cb91-4bd4-9db0-0e02d0d6f3e8",
        "value": "adsparkpro.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501199",
        "to_ids": true,
        "type": "domain",
        "uuid": "8f9115c4-41bd-4541-8a8c-5f97c955bb2d",
        "value": "adsparkpro.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501220",
        "to_ids": true,
        "type": "domain",
        "uuid": "116ff034-eaf2-4cc5-a74c-c78d08f7a642",
        "value": "softwe.art",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501241",
        "to_ids": true,
        "type": "url",
        "uuid": "871bee01-3722-4197-aa09-a0659bc0d356",
        "value": "https://atsheisdomestic.org/update-thanks.html",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501262",
        "to_ids": true,
        "type": "url",
        "uuid": "32a36208-c297-4c30-bc0a-00f324cdc900",
        "value": "https://etoftheappyrince.org/update-delay",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780501283",
        "to_ids": true,
        "type": "url",
        "uuid": "a321a43b-1bd5-4b5f-ad7d-eb9935edcffb",
        "value": "https://healightejustb.org/checkupdateTO.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501304",
        "uuid": "a5cbee22-d79b-41ec-bcde-df6d8d752325",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501304",
            "to_ids": true,
            "type": "md5",
            "uuid": "3f3f715e-e919-4944-9ca6-21230c338922",
            "value": "8e3490c4fbfd91c293733594d9bb910e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498068",
            "to_ids": true,
            "type": "sha1",
            "uuid": "64fed370-24e2-4056-8801-502152c08b6b",
            "value": "753a0aa69c3c2766e41653d2ec2e181e7a2a1419",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498068",
            "to_ids": true,
            "type": "sha256",
            "uuid": "02c32771-0459-4fa6-b693-2151cfd0c41b",
            "value": "021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b845",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497585",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "373f8aa3-3b66-4e4d-9aa9-36fe396139bb",
            "value": "393216:VgTSqUvQzOzPTQ6tFaiPVji1TbNAqKtqqjlUiId7sQHTM6aVOaVGtsNNzwMGjI0:VgdEQzODE9iY/lV7fobVSsXus"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497585",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c9bf1cd8-5bba-4c9a-b5f6-7acdd84f9ba8",
            "value": "19904525"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497585",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b98a0450-c0da-4a8c-9392-be6844151e1f",
            "value": "cf58443631de630f41b2d31b5dca0bc3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497585",
            "to_ids": true,
            "type": "filename",
            "uuid": "cc2a659c-17b6-4a98-ae2d-19f6dc4b9616",
            "value": "com.app.podcastsLounge"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497585",
            "to_ids": false,
            "type": "text",
            "uuid": "22595908-0441-4684-9552-ab5277be8a01",
            "value": "Type Description: Macintosh Disk Image\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2025-12-12T18:23:20.000000+00:00\nLast Submission:2025-12-31T07:41:16.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501325",
        "uuid": "a4fbb004-a401-427a-9b9b-63206cbdd19e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501325",
            "to_ids": true,
            "type": "md5",
            "uuid": "9f95ca42-78a7-44d7-b855-a4a0ca425a53",
            "value": "638b0a77a6d686849a78b500adf5e565",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498069",
            "to_ids": true,
            "type": "sha1",
            "uuid": "cf72c841-682e-459f-ad30-68dfa0c4e8f7",
            "value": "c40126fea6ed24652a3e4e19205075cb02cca3e2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498069",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4b831b1a-063f-4623-81b4-a7220b97a2ea",
            "value": "363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc34",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497628",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bd90315a-8678-4de0-bc2d-a3141dee15e2",
            "value": "6144:bvcRBH2Vx1reuvmPzEva3Z3Vx1YV1pb4fm:gjb"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497628",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a29df895-cfad-4335-91a7-4fda4591000b",
            "value": "338832"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497628",
            "to_ids": true,
            "type": "vhash",
            "uuid": "1d247899-214c-435d-bb4c-4a9bfea6714b",
            "value": "74b5e6e00fa0cd43a188d178bda07e46"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497628",
            "to_ids": true,
            "type": "filename",
            "uuid": "72b43b99-30c7-427b-8bd7-92ca9890ee92",
            "value": "com.app.podcastsLounge"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497628",
            "to_ids": false,
            "type": "text",
            "uuid": "b3e5765d-5ffd-40dd-b954-a41033d9c7c8",
            "value": "Type Description: Mach-O\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2025-12-02T15:45:51.000000+00:00\nLast Submission:2025-12-02T15:45:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501347",
        "uuid": "ea38dfe9-f795-45ae-a2e4-32c7ab6f6ecd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501347",
            "to_ids": true,
            "type": "md5",
            "uuid": "38305b35-14a8-48e1-8776-fa1517a0c9d2",
            "value": "9036416620a0a5dd0ef33717ccb00cf2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498070",
            "to_ids": true,
            "type": "sha1",
            "uuid": "04f28ef5-cebe-43a7-8731-5693ad5871f0",
            "value": "b596e29eb02cd5c90efece8007ec74df6b847d15",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498071",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f9ab052b-cc04-4a35-b50d-4950ea22538b",
            "value": "644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e70",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497671",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "41eeac26-d246-422f-924f-f4dc1f732e99",
            "value": "393216:FW0v/DxmjGyzgpDH5pnT8p/jIFPxArV8kqUkDEIVlZGq4pA5o/5dEA0TYJLoliQy:0W1mepz5pT5F5Lk4VlD4pA5YE2mtUa7H"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497671",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "21797208-34d0-4d4b-bf6b-38a4257f550c",
            "value": "22945469"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497671",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ef93c663-4096-4023-8d06-de8766b4f9a1",
            "value": "6f673bc1677048070623ac9166a5d007"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497671",
            "to_ids": true,
            "type": "filename",
            "uuid": "d9259a6f-9447-44b3-98f7-65f29b05b97c",
            "value": "com.app.pdfBrain"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497671",
            "to_ids": false,
            "type": "text",
            "uuid": "712b150e-a430-4106-b3a6-589eae14d8a6",
            "value": "Type Description: Macintosh Disk Image\nMicrosoft: None\nVT Total Detection:1/61\nFirst Submission:2026-01-12T06:58:33.000000+00:00\nLast Submission:2026-01-19T09:34:55.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501368",
        "uuid": "94f9d6e7-5aaf-4ff5-8279-55d9f54a352d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501368",
            "to_ids": true,
            "type": "md5",
            "uuid": "8c609915-2ffa-48c6-99b9-145c30b2af16",
            "value": "4bac4193f3e4df1d8479c36ccb768ee6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498072",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3844e216-cc89-4c54-afaa-254699699a7f",
            "value": "60554e93153e78681954d9f272e6b93f3efd286e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498072",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1308d5a6-54fd-47ab-88a0-babb06c7dd15",
            "value": "8421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b2533109",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497693",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "33205147-830d-4fa2-8fd0-41e5f6fcaa70",
            "value": "196608:vgjlg2VEUKKoEVxu/HBd1bcDPhUWzzgUoRzKP+KbQ:KlxuJYhUWnWK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497693",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "af75c45c-9603-438f-bc06-b85a55b8a1ad",
            "value": "13819216"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497693",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a0fea056-af8a-498e-b0bb-4c5a47ed9822",
            "value": "99838228393aa54680f18e1dfbeccd81"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497693",
            "to_ids": true,
            "type": "filename",
            "uuid": "9ee79beb-bad9-49be-b9fc-da34f9fb0aac",
            "value": "io.flutter.flutter.app"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497693",
            "to_ids": false,
            "type": "text",
            "uuid": "ec0c8eaa-01fc-4e8b-b08e-052a56c6d34f",
            "value": "Type Description: Mach-O\nMicrosoft: None\nVT Total Detection:1/63\nFirst Submission:2025-12-02T15:44:58.000000+00:00\nLast Submission:2025-12-02T15:44:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501389",
        "uuid": "39853c3f-d0af-49f0-a16d-7cf8b53edd55",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501389",
            "to_ids": true,
            "type": "md5",
            "uuid": "490e916e-6f6a-43cd-9476-f4233b0e394e",
            "value": "834ff7d9ee5a2556746b19c82d24ad4c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498073",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a8e4ce03-788b-4cf1-ad74-288c855d6bf0",
            "value": "65ffcb4b288f718f0cd6265cb7826c500b927b45",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498073",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a2e1641e-8e6d-4f2c-876e-092016132b41",
            "value": "9053e8ddaecca1f960c041c944ca8799fc71dc86a4b50d2639ee4e0d2cb82f47",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497716",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "645ed392-b2fc-4c55-84b7-e38929ac54b9",
            "value": "6144:NINww/xsHoCbx1T8tchGJtWCbx1dCNTh:NiwwrecJEPT"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497716",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7806e2df-9fa9-4a4c-9775-511e655e069c",
            "value": "311760"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497716",
            "to_ids": true,
            "type": "vhash",
            "uuid": "129c2d0e-8109-47cd-acb1-64bd534bd5e8",
            "value": "4230cb7c000034b887ddb89a6618c9db"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497716",
            "to_ids": true,
            "type": "filename",
            "uuid": "9fb9e642-cc61-4a47-a475-091d0b22f656",
            "value": "com.app.pdfBrain"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497716",
            "to_ids": false,
            "type": "text",
            "uuid": "257e76eb-f689-43b2-a966-cc9d5335c86e",
            "value": "Type Description: Mach-O\nMicrosoft: None\nVT Total Detection:0/64\nFirst Submission:2026-01-12T07:00:12.000000+00:00\nLast Submission:2026-01-12T07:00:12.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780501411",
        "uuid": "45ce3fa7-2c3b-4a41-a820-71da7e8ce47e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780501411",
            "to_ids": true,
            "type": "md5",
            "uuid": "7d9979cf-7880-4241-8881-11a0283b2ddf",
            "value": "5051f9756a5d2950589239d2803970dc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780498074",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d29c6943-96e0-4fbe-b01e-e96255ad3470",
            "value": "8381b7a2174ff593ff61b0bb059194b93abdbcce",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780498074",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0e08f42c-c8e4-45fa-9384-41dec48c5e23",
            "value": "b60074d1ea2008a581f432f2dee5f84f78668d9dd8e66f75d03c42dabd89bdea",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780497759",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "41e75920-350f-4b8d-8c28-10d534eb2054",
            "value": "196608:vYx8LU/QUPbpz7ePlh8ouypT68gQ4DKON2D/hxlSVuMfL1bgBCXtBy:vuypiOON2Dcz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780497759",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6e380c3c-fbda-46ae-b3a5-ebceb20aff5a",
            "value": "20755856"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780497759",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f1e9dc16-78ce-4670-a444-38e1a4f3e750",
            "value": "99838228393aa54680f18e1dfbeccd81"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780497759",
            "to_ids": true,
            "type": "filename",
            "uuid": "0cb657ee-1c2a-42f4-8a56-84b44ca685c3",
            "value": "io.flutter.flutter.app"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/06/2026\nLast-scan\t:  03/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780497759",
            "to_ids": false,
            "type": "text",
            "uuid": "8c2348cc-3b85-401c-a9d1-5ec0791e5ecf",
            "value": "Type Description: Mach-O\nMicrosoft: None\nVT Total Detection:1/63\nFirst Submission:2026-01-12T06:58:55.000000+00:00\nLast Submission:2026-01-12T06:58:55.000000+00:00"
          }
        ]
      }
    ]
  }
}