{
  "Event": {
    "analysis": "1",
    "date": "2026-07-02",
    "extends_uuid": "",
    "info": "[Threat Intel] AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign",
    "protected": false,
    "publish_timestamp": "1784200135",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784200135",
    "uuid": "e7521375-6730-4416-afe2-5891321d0d60",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"AsyncRAT\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Remcos\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783076434",
        "to_ids": false,
        "type": "link",
        "uuid": "735ab3fe-e795-45c1-bbfe-7d99625a5059",
        "value": "https://www.levelblue.com/blogs/spiderlabs-blog/asyncrat-and-remcos-delivered-in-multi-stage-phishing-campaign"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783076434",
        "to_ids": false,
        "type": "text",
        "uuid": "ca1bfdc5-6036-4297-afbf-97586f7d8bec",
        "value": "A widespread phishing campaign distributing AsyncRAT and Remcos RATs has been observed targeting organizations across manufacturing, media, professional services, agriculture, and chemical industries globally. The attack leverages malicious Excel spreadsheets sent via emails impersonating business communications like purchase orders and payment advice. When macros are enabled, VBA code retrieves HTA payloads through URL shorteners and Cloudflare Workers infrastructure. The multi-stage infection chain employs heavy obfuscation including Base64 encoding, steganography in PNG files, and character substitution. The campaign intensified during June 2026, affecting organizations across Europe, Asia-Pacific, and the Americas. Infrastructure includes distinctive HTA naming conventions using concatenated positive English words. The operation likely uses automation for payload generation and may leverage LLMs for development efficiency."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783076434",
        "to_ids": false,
        "type": "text",
        "uuid": "16d0add4-0fb5-409e-a624-504c85de5999",
        "value": "Name: AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"formbook\", \"steganography\", \"asyncrat\", \"remcos\", \"vba macros\", \"url shorteners\", \"lumma\", \"multi-stage infection\", \"cloudflare workers\", \"hta payload\", \"phishing campaign\", \"spreadsheet dropper\"]\nTgtd countries: []\nMlwr families: [\"AsyncRAT\", \"Remcos\", \"FormBook\", \"Lumma\"]\nAttack_ids: [\"T1056.001\", \"T1059.007\", \"T1204.002\", \"T1566.001\", \"T1497\", \"T1102\", \"T1218.005\", \"T1547.001\", \"T1027\", \"T1573\", \"T1071.001\", \"T1059.005\"]\nIndustries: [\"Manufacturing\", \"Media\", \"Agriculture\", \"Chemical\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784157988",
        "to_ids": true,
        "type": "url",
        "uuid": "415bcd8c-920a-46a6-8331-4af4db4a3f8d",
        "value": "http://ffgfgjjddsgtrddhtjyfdsessxdssdfdfdfghfhg.duckdns.org:14647",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158009",
        "to_ids": true,
        "type": "url",
        "uuid": "75517c4c-c413-4cf4-8b4c-5edfc37dba3e",
        "value": "http://107.172.235.213/87/img_015059.png",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158030",
        "to_ids": true,
        "type": "url",
        "uuid": "cbc802c4-a20f-4639-963e-ae3a708232e0",
        "value": "http://107.172.135.60/96/ibredgoodforbestthingscomingbackform.hta",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158051",
        "to_ids": true,
        "type": "url",
        "uuid": "9d567fae-bdfa-4ac3-b50b-ed7290bcab9d",
        "value": "https://as.al/file/KBn1RC",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158074",
        "to_ids": true,
        "type": "domain",
        "uuid": "1b3b0f0c-3da4-4cfc-8a6b-cc0c72378acd",
        "value": "cuth.me",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158095",
        "to_ids": true,
        "type": "url",
        "uuid": "f95099d8-021a-4b86-a364-6dacdd49e0e9",
        "value": "http://198.12.83.75/98/img_194618.png",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158116",
        "to_ids": true,
        "type": "url",
        "uuid": "52069138-3685-4f99-8de9-8b03224e804d",
        "value": "https://cuth.me/sse8kU",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e492b1a2-2016-4aa1-8e10-ffea12fbfc77",
        "value": "ffgfgjjddsgtrddhtjyfdsessxdssdfdfdfghfhg.duckdns.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158158",
        "to_ids": true,
        "type": "url",
        "uuid": "aa0221cc-f04d-49fa-a661-dad653026c12",
        "value": "http://as.al/file/KBn1RC.",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158179",
        "to_ids": true,
        "type": "url",
        "uuid": "0f3ce160-ce4e-4ab1-a4e9-e974b8e4f901",
        "value": "https://masuk.to/FdpxBG",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 14641",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784152489",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "ba15d0e5-39a0-4e91-8ecc-70a51f745c6d",
        "value": "173.231.188.244|14641"
      },
      {
        "category": "Network activity",
        "comment": "On port 4550",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784152489",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "061cc509-a30d-4542-ae94-18b2a948742a",
        "value": "192.227.219.79|4550"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158200",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d9d0a31d-e7a9-4563-a96a-f8072c482854",
        "value": "icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158221",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f54ac6b3-6686-4b1d-bda9-94320acd59d7",
        "value": "dawn-bush-ddd1.yasminanthonyy.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784158243",
        "to_ids": true,
        "type": "hostname",
        "uuid": "92fea222-920e-4ef5-93ca-5bff36624260",
        "value": "small-morning-8be0.fsocietyandtools.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-11T04:19:09+00:00",
        "last_seen": "2026-06-11T04:19:09+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784158264",
        "uuid": "2699fe2e-ddb5-4bc5-a140-0933577034ea",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "md5",
            "timestamp": "1784158264",
            "to_ids": true,
            "type": "md5",
            "uuid": "0b6a6f78-5d6e-438b-a169-3c610eeeedb0",
            "value": "7efc7341472dc671779c0ca8d4e8ac5c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "sha1",
            "timestamp": "1784154183",
            "to_ids": true,
            "type": "sha1",
            "uuid": "24f90a16-2539-4acd-8851-ba4cb58c14af",
            "value": "b36519598b8cd8ebcc959965db5dba1ace8d78a6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "sha256",
            "timestamp": "1784154184",
            "to_ids": true,
            "type": "sha256",
            "uuid": "dada8c0b-f27a-46f4-8d71-a8f096678012",
            "value": "49c7b4eb6620917ee7ca796472b7af9f01ea6f7f80391ae7eb7bd8dabe0b7249",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 16/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "text",
            "timestamp": "1784153944",
            "to_ids": false,
            "type": "text",
            "uuid": "f8cceea5-9ac9-4f0c-a9a2-38dbf69a4456",
            "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: None\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2026-06-11T04:19:09+00:00\nLast Submission: 2026-06-11T04:19:09+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784153944",
            "to_ids": false,
            "type": "datetime",
            "uuid": "31908750-66c4-4018-b4fd-1fc4e0e22273",
            "value": "2006-09-16T00:00:00+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784153944",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b4a39a5d-ab84-49f5-b2f5-fd471ff6c5ff",
            "value": "1536:cKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhAaUVuA2P4hCH9VABnjr:cn1LZvTTZGzN6YZ5wWAafA2P4hsOM"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784153944",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "97cfbf83-308e-49fe-96e4-708719269598",
            "value": "127488"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "vhash",
            "timestamp": "1784153944",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e4b0f8a1-e4f1-4979-b46f-25b957ed9a12",
            "value": "13c58281c7aa6f14ba8de31ef84a79f7"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T04:19:09+00:00",
            "last_seen": "2026-06-11T04:19:09+00:00",
            "object_relation": "filename",
            "timestamp": "1784153944",
            "to_ids": true,
            "type": "filename",
            "uuid": "f71f1c87-34c6-40ff-a6ba-1d31556c2848",
            "value": "7efc7341472dc671779c0ca8d4e8ac5c.file"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-11T06:32:12+00:00",
        "last_seen": "2026-06-21T04:03:49+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784158285",
        "uuid": "f0cf3530-5498-41c0-b3ad-ec283d943b55",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "md5",
            "timestamp": "1784158285",
            "to_ids": true,
            "type": "md5",
            "uuid": "d329e2a8-197e-4024-9ba6-9e3a17a7f1a5",
            "value": "5e16dd79001f2faba4569e2abd5b19c0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "sha1",
            "timestamp": "1784154185",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d8eff8bb-ec71-4b96-85a4-3f9f8b4263f3",
            "value": "d044d5b8ba9c7abc203a0ff5688702c7f45b54cd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "sha256",
            "timestamp": "1784154185",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b42202dd-5228-4f47-9f94-d96963867045",
            "value": "eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 16/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "text",
            "timestamp": "1784153965",
            "to_ids": false,
            "type": "text",
            "uuid": "6e52b3cd-6ace-4278-8488-ad15d024d98f",
            "value": "Type Description: JavaScript\nMicrosoft: TrojanDownloader:JS/Obfuse!MSR\nClamAV: None\nVT Total Detection: 27/74\nFirst Seen In The Wild: 2026-06-11T07:00:53+00:00\nFirst Submission: 2026-06-11T06:32:12+00:00\nLast Submission: 2026-06-21T04:03:49+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784153965",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8ce928c6-2d37-432d-a748-4d65a9497793",
            "value": "384:MDLoivy7BQ5gNN1CD1ZVlLE5g5TlwzlOmYG8tQmQmmYG8t5BHmmKt6qA8ZCD6cZe:MUTXmK"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784153965",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "78faee55-4951-4169-85c6-0050695b000c",
            "value": "27826"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-11T06:32:12+00:00",
            "last_seen": "2026-06-21T04:03:49+00:00",
            "object_relation": "filename",
            "timestamp": "1784153965",
            "to_ids": true,
            "type": "filename",
            "uuid": "26b15ced-6dd8-44ff-8416-cb2a837af8e7",
            "value": "goodthingsformebetterforme.hTA"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-12T10:13:14+00:00",
        "last_seen": "2026-06-12T12:21:07+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784158306",
        "uuid": "69b0780f-e3ba-4c20-8056-69ed0873393e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "md5",
            "timestamp": "1784158306",
            "to_ids": true,
            "type": "md5",
            "uuid": "32cd38a3-418c-4c32-a2d4-98470e001ce5",
            "value": "d924b7e4d3fc4bc02422057ebe87dcdd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "sha1",
            "timestamp": "1784154186",
            "to_ids": true,
            "type": "sha1",
            "uuid": "668e4e93-a160-4b1f-91b3-18df57dc0fb2",
            "value": "6c2f10ec18c34ea9ba423b19e6ccf228ecf47a31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "sha256",
            "timestamp": "1784154186",
            "to_ids": true,
            "type": "sha256",
            "uuid": "05871b84-6d82-4bc4-bbd8-0db1c0a7ea55",
            "value": "bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 16/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "text",
            "timestamp": "1784153987",
            "to_ids": false,
            "type": "text",
            "uuid": "6e48bb20-88e7-4d99-a71c-1ea5101ffe87",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 27/74\nFirst Seen In The Wild: 2026-06-13T10:52:51+00:00\nFirst Submission: 2026-06-12T10:13:14+00:00\nLast Submission: 2026-06-12T12:21:07+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784153987",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4aea7ae5-fb30-416b-8cc4-0c6f1e50aa1b",
            "value": "96:vTpplO3lKphxD9lypq9aPrK48/jT1pxe3PRYIt27hkyLEQtDYexeDyArN8l8vAga:rpX6rmfE3b8gBTm2xuuWB0GuAiIKq"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784153987",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5b0e12b9-5b14-40e4-b8eb-b00ee2d95b7d",
            "value": "25319"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "vhash",
            "timestamp": "1784153987",
            "to_ids": true,
            "type": "vhash",
            "uuid": "73a2e293-11e5-4048-acb5-959a069f34c9",
            "value": "9f37ef6b2db6dd0fb2704c1801d2d37d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-12T10:13:14+00:00",
            "last_seen": "2026-06-12T12:21:07+00:00",
            "object_relation": "filename",
            "timestamp": "1784153987",
            "to_ids": true,
            "type": "filename",
            "uuid": "59a637b3-8d83-49f6-a6af-8bc21a3cb6bc",
            "value": "givenmebreakwithbestthingsgood.hta"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-12T18:19:32+00:00",
        "last_seen": "2026-06-14T11:50:37+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784158327",
        "uuid": "1b468cb7-0ce3-4ae3-8a62-e2bf21afe0aa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "md5",
            "timestamp": "1784158327",
            "to_ids": true,
            "type": "md5",
            "uuid": "f7ea7204-b340-4f09-960e-465d49e7c97f",
            "value": "026e6e27fe574cd05c83c82610046ba2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "sha1",
            "timestamp": "1784154187",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9069b0e9-8e40-4985-b7ee-04b040e8bd6c",
            "value": "4ca48fb14e6f26d617c77d219ae5529935bb4893",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "sha256",
            "timestamp": "1784154187",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e323f337-8990-4e6f-8d74-bac5aebc9fb0",
            "value": "0542b57b67b021f877969c900214362d62eb2ba56d0645ab4e62838c8c79733a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 16/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "text",
            "timestamp": "1784154009",
            "to_ids": false,
            "type": "text",
            "uuid": "f0c669d0-8a94-4071-a1f3-6e11cceb4a3f",
            "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 26/74\nFirst Seen In The Wild: 2026-06-13T12:51:48+00:00\nFirst Submission: 2026-06-12T18:19:32+00:00\nLast Submission: 2026-06-14T11:50:37+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784154009",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9e0bcbf9-d32a-491c-be43-ec98e5cfd9f0",
            "value": "768:tWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW+:ulGeNXpeVugCCostPqaWriNU"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784154009",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "08ec6da7-210c-4f77-be10-87d4dbe3bb8f",
            "value": "25599"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-12T18:19:32+00:00",
            "last_seen": "2026-06-14T11:50:37+00:00",
            "object_relation": "filename",
            "timestamp": "1784154009",
            "to_ids": true,
            "type": "filename",
            "uuid": "10f65eb0-b17c-42f5-bc69-067cc5385ad9",
            "value": "goodthingswithbetterworldcoming.htA"
          }
        ]
      }
    ]
  }
}