{
  "Event": {
    "analysis": "1",
    "date": "2026-06-19",
    "extends_uuid": "",
    "info": "[Threat Intel] OXLOADER: new loader evading detection to drop infostealer",
    "protected": false,
    "publish_timestamp": "1782443590",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782443590",
    "uuid": "e2504796-72b5-47db-a123-01eeef43e326",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#5f1b93",
        "local": false,
        "name": "misp-galaxy:producer=\"Elastic\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"russia\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866815",
        "to_ids": false,
        "type": "link",
        "uuid": "cf7356d9-127a-494e-b181-04c90c9b26c1",
        "value": "https://www.elastic.co/security-labs/oxloader-malware-loader-infostealer"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866815",
        "to_ids": false,
        "type": "text",
        "uuid": "3bd9916a-60cc-4cac-b993-ee91d2b37831",
        "value": "A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predicates, and mixed Boolean-Arithmetic techniques, along with self-modifying decryption stubs and abuse of the Windows .reloc section for shellcode staging. Distribution occurs via malvertising impersonating Node.js installations, redirecting victims through intermediary domains to Storj-hosted batch scripts. The loader implements five anti-VM and language checks, including CIS-region and Russian-language exclusions, suggesting a financially motivated Russian-speaking threat actor. OXLOADER uses DonutLoader to deliver the .NET-based CASTLESTEALER payload in memory, evading traditional detection mechanisms through deliberate engineering choices."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781866815",
        "to_ids": false,
        "type": "text",
        "uuid": "d7312356-9dfe-46ed-956c-b0b665414a6f",
        "value": "Name: OXLOADER: new loader evading detection to drop infostealer\nAuthor: AlienVault\nAdversary: \nTags: [\"oxloader\", \"donutloader\", \"reloc section abuse\", \"malvertising\", \"obfuscation\", \"anti-vm\", \"google ads\", \"castlestealer\", \"russian-speaking actor\", \"infostealer\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"OXLOADER\", \"CASTLESTEALER\", \"DonutLoader\"]\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782441919",
        "to_ids": true,
        "type": "url",
        "uuid": "5dc929c3-42ce-4e34-be10-2a4905aaac26",
        "value": "http://app.miloyannopoulos.com/download",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782441941",
        "to_ids": true,
        "type": "url",
        "uuid": "f8c0c516-7d41-4a7b-99e1-50477a4de09f",
        "value": "http://app.miloyannopoulos.com/download?subid1=download",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782441962",
        "to_ids": true,
        "type": "url",
        "uuid": "b5f617b7-524d-4ad3-bf72-1aa7b0680619",
        "value": "http://link.storjshare.io/raw/jux4e4ky5mruo4jkxsssp42sau4q/ruslan/BATPackageBuilderSetup.bat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782441983",
        "to_ids": true,
        "type": "url",
        "uuid": "4272b56f-2a0c-4ef0-8649-39f15928978b",
        "value": "http://link.storjshare.io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442005",
        "to_ids": true,
        "type": "url",
        "uuid": "26e5359b-fc36-4318-8ae0-f3bed622d11c",
        "value": "https://link.storjshare.io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.bat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442026",
        "to_ids": true,
        "type": "url",
        "uuid": "d1109315-30f2-4c7b-8d57-27aac2f1ce32",
        "value": "https://link.storjshare.io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442047",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4ec2da53-a35f-4312-9a59-5c228bf0d7a1",
        "value": "node-js.prentiva99.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Malvertising Redirector",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442068",
        "to_ids": true,
        "type": "hostname",
        "uuid": "811738f4-4ea0-4942-89c1-9b427e855cd4",
        "value": "app.miloyannopoulos.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "CASTLESTEALER C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442089",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2d86290f-0f74-4397-bba2-9ca30e0f41fe",
        "value": "89.124.95.161",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "CASTLESTEALER C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442110",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "715b5357-e293-40fa-81e2-006ed15beb2a",
        "value": "89.124.115.82",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442131",
        "uuid": "cb60b50f-9ec9-4016-b081-94c833aae33a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "CASTLESTEALER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442131",
            "to_ids": true,
            "type": "md5",
            "uuid": "ef828b6a-d5fc-4a22-a5a6-a4ea16c54d17",
            "value": "671ebba9330be714acdc860243772e2e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "CASTLESTEALER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367207",
            "to_ids": true,
            "type": "sha1",
            "uuid": "235c51d0-9563-4a98-8c6b-0f59967b33c5",
            "value": "1b7573c70385921f95349a61d0c397881f43864d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "CASTLESTEALER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367207",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b1fc79fa-af1c-44fb-b615-f99e22e3d7cb",
            "value": "39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366462",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b09364fb-97f3-41e0-a979-91d678b4fe8e",
            "value": "1536:lmi4nSL9Bx6Z5kBnFdvahfy3fz4G2V9ibJ4rs0fIcGB6jO6DbUvEnlg0+T6YyaSk:wi4nSLx3Jsy7ZbJAbbPbUjRbF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366462",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ea199edc-c1b1-4ef7-b92a-1d9a48c4ee96",
            "value": "147968"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366462",
            "to_ids": true,
            "type": "vhash",
            "uuid": "7aaef3f5-aaaa-4bea-867a-c658805848b9",
            "value": "015026551\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366462",
            "to_ids": true,
            "type": "filename",
            "uuid": "41b58404-0870-4be6-b7ef-ebca0eeee8e4",
            "value": "5i3gb46lu.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366462",
            "to_ids": false,
            "type": "text",
            "uuid": "c828d00c-3f75-4159-94a6-f63fe0d76ec5",
            "value": "CASTLESTEALER\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:50/70\nFirst Submission:2026-05-21T14:28:52.000000+00:00\nLast Submission:2026-05-21T14:28:52.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442152",
        "uuid": "a42d22fc-0b39-4db5-804a-61aa188c888e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "CASTLESTEALER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442152",
            "to_ids": true,
            "type": "md5",
            "uuid": "64b1512a-af41-4159-b547-b50c13edae93",
            "value": "80726e6b131012bcd08e76891c46389f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "CASTLESTEALER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367209",
            "to_ids": true,
            "type": "sha1",
            "uuid": "264ad59b-1999-4673-bdaa-4e9b74911189",
            "value": "40458c505e09fab360285ca73dfeeab1a238537b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "CASTLESTEALER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367209",
            "to_ids": true,
            "type": "sha256",
            "uuid": "08bac5bc-4c0f-47e5-a1cc-ef45ab0aacdd",
            "value": "4ec9d9d4d10ad78fc6d7bda7cb17d52984878ccd2dd4302fd1cef152313b9741",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366484",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "29d23d33-1ee4-4e92-97ab-cbb354d6cdcc",
            "value": "1536:p2R0+J8vhfQ32TLHNQVwq0osnrVpOuHEsIxSvVeRbLgGL9zvbqVUPWqXrv0IwwBP:QwpHCVwHI9x4e1L3L97bqaE3cyc"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366484",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "107f83ad-a0bf-4423-bb93-ff6d649b314e",
            "value": "207360"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366484",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c4e7ca21-9fab-479b-bfc9-60ee7fc6c61f",
            "value": "025026551\"z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366484",
            "to_ids": true,
            "type": "filename",
            "uuid": "d5caf1bf-949a-4ea0-9230-bc790abc28ed",
            "value": "we6tq8h.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366484",
            "to_ids": false,
            "type": "text",
            "uuid": "7056c067-6d0d-452d-a651-e1b0458449ce",
            "value": "CASTLESTEALER\r\nType Description: Win32 EXE\nMicrosoft: Trojan:MSIL/CastleStealer.CZ!MTB\nVT Total Detection:48/70\nFirst Submission:2026-05-21T14:27:11.000000+00:00\nLast Submission:2026-05-21T14:27:11.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442173",
        "uuid": "1687b128-d5b6-4b1f-80b9-1fd768747ece",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "OXLOADER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442173",
            "to_ids": true,
            "type": "md5",
            "uuid": "4382382f-968f-4b9c-868e-88b8834d080f",
            "value": "77cc3c0fecc58b5b696f08858a214969",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367210",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7edb14e5-1396-4460-baa2-4aeb6aabe6cf",
            "value": "1591ab9bf31f3e22555dd2320d9ab386d8f3a4b8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367210",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2423ebe2-6442-48ea-b572-c69ed08f9169",
            "value": "9a9939dff297997732aaade9b243d695632cbd64033c5fbcb9de3d09b7e6c28d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366506",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "295b5aa5-1201-4da1-99ea-db190ab14ace",
            "value": "98304:sIjX4aMjPxpfVWhqfuUa+RDoj9ghi1RebMIg9Cbk/V8yHbwYmR:pD4aMjPx4mDojDIg9Cbk/V8yHb7mR"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366506",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "028f6257-ff92-476d-a5ae-20989161eb52",
            "value": "6395904"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366506",
            "to_ids": true,
            "type": "vhash",
            "uuid": "442b0d9b-9bad-473e-89fc-3cb4cc83a6ec",
            "value": "06608e651d15635555757200803006300c63zd001d0a4z100b00eb031z19z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366506",
            "to_ids": true,
            "type": "filename",
            "uuid": "3cfdf809-0d84-4da0-99d0-82bc6fc6f04d",
            "value": "apimonitor-x64.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  25/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366506",
            "to_ids": false,
            "type": "text",
            "uuid": "c6ba367c-86f4-406c-8be9-e701059d44ce",
            "value": "OXLOADER\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/Oxloader.CA!MTB\nVT Total Detection:29/71\nFirst Submission:2026-05-01T22:32:45.000000+00:00\nLast Submission:2026-05-01T22:32:45.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442195",
        "uuid": "fc878aad-f6c8-4ae8-bd99-06be09f77d98",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "OXLOADER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442195",
            "to_ids": true,
            "type": "md5",
            "uuid": "73b19b8f-9758-482c-a159-cdcc9604154e",
            "value": "1b3aec930a87a8da976702a788e22005",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367211",
            "to_ids": true,
            "type": "sha1",
            "uuid": "033282da-52f4-4aad-8509-dfa56f4f8c54",
            "value": "aec7a32b6af0b43b4e8c64eb5e99e2a5e113d13b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367211",
            "to_ids": true,
            "type": "sha256",
            "uuid": "93073482-3650-4f4f-ae76-671e519cbda2",
            "value": "c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366527",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "46291a52-4d80-43c9-bcb8-af40cfa0cc20",
            "value": "393216:k/7deQv/7kztGylfH5WbmK8QFoHgH3A5d0FWNTUUFBTInBKjk3k:k/hg0FW7B07k"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366527",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "47c163e2-5ae9-421b-b76d-baea9dc3d715",
            "value": "40418304"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782366527",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3a984ca4-76cc-448b-9d95-ebc590263ac0",
            "value": "04708e655d556d05557e6162z122zf47z7053z1033z64z264z1f3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366527",
            "to_ids": true,
            "type": "filename",
            "uuid": "3ba7fd6b-e3d9-493b-848d-0274e193a267",
            "value": "node-v24.15.0-x64-86.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366527",
            "to_ids": false,
            "type": "text",
            "uuid": "213bbe66-1282-4b8e-b05f-dc30f9526bee",
            "value": "OXLOADER\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:29/70\nFirst Submission:2026-05-11T13:36:38.000000+00:00\nLast Submission:2026-06-19T12:23:02.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442216",
        "uuid": "12b8a258-d837-4f2a-ae4f-bfe338c7d575",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "OXLOADER downloader & launcher",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442216",
            "to_ids": true,
            "type": "md5",
            "uuid": "dd5fe203-f8fa-48be-9bcb-b3ff9809c39c",
            "value": "9bfacce695de7b046d2af27385bb778e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER downloader & launcher",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367213",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bf0ede65-85c7-4586-9dc9-23bda6ce1307",
            "value": "4f894e48a61ce53884f41dec6e1665d556cee4c6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER downloader & launcher",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367213",
            "to_ids": true,
            "type": "sha256",
            "uuid": "54d9131c-1cad-41b0-bb3f-38c726c86790",
            "value": "de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366549",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "99ac462d-ba10-43dc-ac76-5d91d2b3f1b1",
            "value": "24:9WYgy4niNjW39bX9Y2MU/vithxMlj2rLxUfmRmP:99XphYr9T35l2rGfmRmP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366549",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "68b9d914-c94d-420b-896d-a712cafe9783",
            "value": "1105"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366549",
            "to_ids": true,
            "type": "filename",
            "uuid": "0ffc2f84-9215-4c8c-8656-1a156293e557",
            "value": "BATPackageBulderSetup.bat"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366549",
            "to_ids": false,
            "type": "text",
            "uuid": "66bd3062-6c8b-459f-80b5-258ab161e10b",
            "value": "OXLOADER downloader & launcher\r\nType Description: DOS batch file\nMicrosoft: Trojan:BAT/Alien.SI!MTB\nVT Total Detection:28/60\nFirst Submission:2026-05-16T11:33:42.000000+00:00\nLast Submission:2026-06-19T12:22:46.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782442237",
        "uuid": "5943989b-89a2-4b9d-892d-412ddcd239e9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "OXLOADER downloader & launcher",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782442237",
            "to_ids": true,
            "type": "md5",
            "uuid": "065f40d6-2385-49ff-9456-38bc61254177",
            "value": "b48829cf38a6d654b16f060d705bfe6d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER downloader & launcher",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367214",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9d8758e9-9157-491f-9df2-187f5e566b48",
            "value": "0f798ddb8e9c5d57d7ee6dda2668f6d2f20d8baf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "OXLOADER downloader & launcher",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367214",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d8ec461e-9939-4f87-9092-3cc420296690",
            "value": "fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782366571",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "65d9d56d-99f8-43d9-bb88-ec188fcbcb01",
            "value": "24:9WYgy4niNVW3XbX9Y2MU/vioh1MfxMlj2rLxUfmRmP:99XpbKr9T31tl2rGfmRmP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782366571",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "83039442-f9c1-4d49-84c4-941871c2ac53",
            "value": "1084"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782366571",
            "to_ids": true,
            "type": "filename",
            "uuid": "bceaf456-d16d-4722-9e6b-490dd3efdb27",
            "value": "BATPackageBuilderSetup.bat"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782366571",
            "to_ids": false,
            "type": "text",
            "uuid": "469ef891-b4e6-4555-bbbf-df291aa49df4",
            "value": "OXLOADER downloader & launcher\r\nType Description: DOS batch file\nMicrosoft: Trojan:BAT/Alien.SI!MTB\nVT Total Detection:24/60\nFirst Submission:2026-05-01T22:32:13.000000+00:00\nLast Submission:2026-05-01T22:32:13.000000+00:00"
          }
        ]
      }
    ]
  }
}