{
  "Event": {
    "analysis": "1",
    "date": "2026-07-28",
    "extends_uuid": "",
    "info": "[Threat Intel] Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers",
    "protected": false,
    "publish_timestamp": "1785643441",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785643441",
    "uuid": "e9649dc9-451a-4039-acb7-8f31a4770ab5",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"alibaba\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"npm\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380421",
        "to_ids": false,
        "type": "link",
        "uuid": "6525ffce-5db0-49d7-b43e-8e5ac273aa2a",
        "value": "https://socket.dev/blog/npm-rat-targets-alibaba"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380421",
        "to_ids": false,
        "type": "text",
        "uuid": "bc1bce55-f4da-4144-ab8b-ee4910982edb",
        "value": "Unknown threat actors distributed malicious downloader functionality across multiple npm packages targeting users of Alibaba tools. The campaign used typosquatting tactics by creating unscoped packages impersonating private packages from Alibaba's @ali scope. Malicious functionality was split across a dependency chain including packages like lib-mtop, smart-config-manager, cloud-config-fetcher, and local-config-parser. The attack employed VM sandbox escape techniques and delivered a sophisticated cross-platform RAT capable of data exfiltration, command execution, and lateral movement through DingTalk collaboration tools. The campaign remained undetected for three months, suggesting possible account takeovers and coordinated publishing across multiple npm accounts in late April 2026, specifically targeting Chinese-speaking developers within Alibaba Group companies for industrial espionage purposes."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785380421",
        "to_ids": false,
        "type": "text",
        "uuid": "46048ecb-8f12-454e-8c6e-85baddc3e39d",
        "value": "Name: Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers\nAuthor: AlienVault\nAdversary: \nTags: [\"dingtalk\", \"industrial-espionage\", \"supply-chain\", \"alibaba\", \"cve-2026-41940\", \"lib-mtop\", \"cross-platform\", \"typosquatting\", \"aone-cli\", \"dependency-confusion\", \"rat\", \"npm\", \"china\"]\nTgtd countries: []\nMlwr families: [\"lib-mtop\", \"aone-cli\"]\nAttack_ids: [\"T1113\", \"T1059.007\", \"T1106\", \"T1005\", \"T1140\", \"T1567\", \"T1136.001\", \"T1090\", \"T1059\", \"T1041\", \"T1547.001\", \"T1027\", \"T1195.002\", \"T1059.006\", \"T1543.001\", \"T1070.004\", \"T1071.001\", \"T1574.002\", \"T1105\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642376",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f6495099-416b-45e4-873b-0d38f23e5e6c",
        "value": "diamond-cli-znsxphqell.cn-shanghai.fcapp.run",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642398",
        "to_ids": true,
        "type": "url",
        "uuid": "86631d92-7d7c-46d5-a736-848ee18c21b7",
        "value": "https://aone-cli-next.oss-cn-beijing.aliyuncs.com/config/setting.js",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642419",
        "to_ids": true,
        "type": "url",
        "uuid": "fe84cac1-921c-49f3-9fe9-6effb20a89c9",
        "value": "https://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.js",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642441",
        "to_ids": true,
        "type": "url",
        "uuid": "af944025-a593-40c8-b3fe-b67fe130957b",
        "value": "https://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli-deps.tar.gz",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642462",
        "to_ids": true,
        "type": "url",
        "uuid": "3bf48f17-b273-467c-857e-b95a7281a0db",
        "value": "https://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642484",
        "to_ids": true,
        "type": "url",
        "uuid": "2f5c56cf-0453-4ee2-9c15-14d84989ed97",
        "value": "https://aone-ai-cli.oss-cn-beijing.aliyuncs.com/app/release/aone-cli.zip",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642505",
        "to_ids": true,
        "type": "url",
        "uuid": "73df670c-0b3f-4210-bf6a-fdff9d5896eb",
        "value": "https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642527",
        "to_ids": true,
        "type": "url",
        "uuid": "38ebe49c-e83a-404c-b668-f756d0646d58",
        "value": "https://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/aone-kit.js",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642548",
        "to_ids": true,
        "type": "url",
        "uuid": "feafd3fb-20b2-4541-91b6-6afccbae1c8e",
        "value": "https://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/app.asar",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642569",
        "to_ids": true,
        "type": "url",
        "uuid": "c816f80a-fc3a-49ae-9caa-3dd4770a3281",
        "value": "https://aone-kit.oss-cn-beijing.aliyuncs.com/aone-kit-update/aone-kit-update",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633249",
        "to_ids": true,
        "type": "md5",
        "uuid": "a88c94d2-9cda-408f-829e-173dc88759a3",
        "value": "3201d407b7899a12d6d439950511c6a5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...tion from attacker controlled GitHub repository: hxxps://raw[.]githubusercontent[.]com/smi1e2u/smart-config-manager/main/defaults/preferences.json The fetched configuration is saved to a local fi...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642590",
        "to_ids": true,
        "type": "url",
        "uuid": "69004203-5e71-4ab7-b6c3-613f5916de48",
        "value": "https://raw.githubusercontent.com/smi1e2u/smart-config-manager/main/defaults/preferences.json",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...r headers to http requests whose values areset to https://alidocs.dingtalk.com to look like it is generated from visitors of the...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642612",
        "to_ids": true,
        "type": "url",
        "uuid": "1529f75e-1145-4b63-9e49-1247caf677be",
        "value": "https://alidocs.dingtalk.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...ud to blend in with the regular traffic: hxxps://aone-cli-next[.]oss-cn-beijing[.]aliyuncs[.]com/config/setting.js This stage uses the same sandb...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642633",
        "to_ids": true,
        "type": "domain",
        "uuid": "8dad40d8-3184-42ca-9922-dfbddfc5b551",
        "value": "aone-cli-next.oss-cn-beijing.aliyuncs.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"....]aliyuncs[.]com/app/release/aone-cli.zip hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto.js hxxps://aone-kit[.]oss-cn-beiji...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642654",
        "to_ids": true,
        "type": "domain",
        "uuid": "42828eb2-7995-4028-a7e9-be34829aafbf",
        "value": "aone-kit.oss-cn-beijing.aliyuncs.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...eijing[.]aliyuncs[.]com/config/setting.js hxxps://aone-ai-cli[.]oss-cn-beijing[.]aliyuncs[.]com/app/release/aone-cli.js hxxps://aone-ai-cli[.]oss...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642675",
        "to_ids": true,
        "type": "domain",
        "uuid": "1443e0bc-da7c-4f33-a049-c7241efd8a1d",
        "value": "aone-ai-cli.oss-cn-beijing.aliyuncs.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...x systems from lib-mtop package C2 Infrastructure xemzqli2vu[.]ai-app[.]pub primary C2 domain diamond-cli-znsxphqell[.]cn-sha...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642696",
        "to_ids": true,
        "type": "domain",
        "uuid": "7b8fc625-504f-4f2e-a67c-288cdb3b2486",
        "value": "xemzqli2vu.ai-app.pub",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...s to http requests whose values areset to https://alidocs.dingtalk.com to look like it is generated from visitors of the...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785642718",
        "to_ids": true,
        "type": "domain",
        "uuid": "bce7f229-1dbe-4d4e-b2b8-2d8bd09c0228",
        "value": "alidocs.dingtalk.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-28T23:52:40+00:00",
        "last_seen": "2026-07-28T23:52:40+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642738",
        "uuid": "e6ad5e38-3c50-4c46-bc0b-ce7b6073e876",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "md5",
            "timestamp": "1785642738",
            "to_ids": true,
            "type": "md5",
            "uuid": "9f30b72b-a2a6-418f-b936-3e704f1fdd1e",
            "value": "6e8086925b4385fec9f022000350bd4f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633239",
            "to_ids": true,
            "type": "sha1",
            "uuid": "87fc9a37-50c6-4076-b71d-4f2fb3404188",
            "value": "1e3f133ab4206f9a257952dbb8bbc284b03753fb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633239",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4915e1eb-e8a0-47a2-9471-4d635c22f7aa",
            "value": "84a6ccaaab1596139d28e822f40cc99c68d337d4c81d1c6d9692c1d6bb22e4af",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "text",
            "timestamp": "1785632778",
            "to_ids": false,
            "type": "text",
            "uuid": "ecff01b3-7d2f-4268-944b-4b642da71842",
            "value": "Type Description: JSON\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/75\nFirst Submission: 2026-07-28T23:52:40+00:00\nLast Submission: 2026-07-28T23:52:40+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632778",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "65aac7f0-c75b-4657-81bc-f137614c3cfe",
            "value": "48:nej/hYua65Y/cA7X1mkLIsmE1znm1Na9YHSKQSCWyjj3Xi3nEEP8X1M:uq//XPm1NiNf3S3EbFM"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632778",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "09034812-1a82-480d-a096-815b87486fb8",
            "value": "2555"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T23:52:40+00:00",
            "last_seen": "2026-07-28T23:52:40+00:00",
            "object_relation": "filename",
            "timestamp": "1785632778",
            "to_ids": true,
            "type": "filename",
            "uuid": "a58269ab-8fda-4921-90b1-94804551df97",
            "value": "preferences.json"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-22T11:41:06+00:00",
        "last_seen": "2026-07-22T11:41:06+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642759",
        "uuid": "e85d4b85-7d0e-4659-9064-f3ad3b9bfb7a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "md5",
            "timestamp": "1785642759",
            "to_ids": true,
            "type": "md5",
            "uuid": "4801c86e-4a5e-4eb3-b127-f6c714b73cbc",
            "value": "b63458f35bfc3fd815635e5e0802ad8c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633240",
            "to_ids": true,
            "type": "sha1",
            "uuid": "eb2bf28c-354b-431b-98fd-de40fccc0867",
            "value": "fd34b305baa08afc14c5221e8f3d17023387e444",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633241",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c224b84e-a6cb-4d27-af66-a119a2b6abf8",
            "value": "6044974c633b3a319c31bb32110411520c425e89722a64806528553227e7a50a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "text",
            "timestamp": "1785632800",
            "to_ids": false,
            "type": "text",
            "uuid": "5d0d8406-41a0-4ecb-934e-a74a8d587db1",
            "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 4/75\nFirst Submission: 2026-07-22T11:41:06+00:00\nLast Submission: 2026-07-22T11:41:06+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632800",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "620e71ec-5e6a-40b1-a70e-a465c21770ae",
            "value": "192:EltLngDsqDL78JBja93z7G9s05mBs4riQ2H8JBeqQaC/SwiFKy8a6yVXE06EhFlZ:Wn89DCO9Y4izhiFV"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632800",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "aecf5197-ce13-46c4-90b5-6d3c9b9ffa1e",
            "value": "17214"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632800",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c50740aa-f857-4913-bb84-8d980bd3e2ac",
            "value": "357c910305e77f694a159478b0da0e60"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-22T11:41:06+00:00",
            "last_seen": "2026-07-22T11:41:06+00:00",
            "object_relation": "filename",
            "timestamp": "1785632800",
            "to_ids": true,
            "type": "filename",
            "uuid": "aea21e0e-bf42-438f-ba15-ca3565946781",
            "value": "setting.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-28T22:16:45+00:00",
        "last_seen": "2026-07-29T02:12:36+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642780",
        "uuid": "2ab0aa26-9878-4123-98c5-68b72dea1d31",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "md5",
            "timestamp": "1785642780",
            "to_ids": true,
            "type": "md5",
            "uuid": "401944de-2f80-461c-bcb6-95ff65b85668",
            "value": "1c2bf43aa96aa5a2e41c58407ec99274",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633242",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6c14b1f5-6947-461c-be4a-badaf610c680",
            "value": "a89521476df474818fb591046ce9256019e14d34",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633242",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1f1733c3-fb37-4331-aa15-b66bbab66404",
            "value": "0910ecfa049738ef3f2540855341a380df89224ff71da94b4c21689fd66f62e3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "text",
            "timestamp": "1785632822",
            "to_ids": false,
            "type": "text",
            "uuid": "06f689fe-2f49-404d-9958-29687f34905f",
            "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 4/75\nFirst Submission: 2026-07-28T22:16:45+00:00\nLast Submission: 2026-07-29T02:12:36+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632822",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "aa155e82-2162-4360-8e23-a0fe934f2878",
            "value": "768:n7w0D7wWce3Av6d+73w3zsyuv4kMoPp9vXQAJH8iLXvn3nk3vVE1PMRW+qIETF39:1+7YzkMoPp+/yH1gA"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632822",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2e09d628-646e-4f26-951a-eec1df2b9441",
            "value": "97385"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632822",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d81b453a-e05a-4a62-a253-69127ae80241",
            "value": "fd0f0926995013703ab63b5b3031dba6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T22:16:45+00:00",
            "last_seen": "2026-07-29T02:12:36+00:00",
            "object_relation": "filename",
            "timestamp": "1785632822",
            "to_ids": true,
            "type": "filename",
            "uuid": "e908eaa5-efbe-4f89-b23d-a2f8b91510e1",
            "value": "aone-cli.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-28T22:13:12+00:00",
        "last_seen": "2026-07-28T22:13:12+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642802",
        "uuid": "01f6bd8b-3121-446d-9bd5-3d3d95878169",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "md5",
            "timestamp": "1785642802",
            "to_ids": true,
            "type": "md5",
            "uuid": "8c1b0c4d-a52c-4721-b0c9-0d5df37c1292",
            "value": "fc2ad6a34807842e9eb9aaee3c7e5dbe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633243",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bc350263-1200-4c28-bfc0-e7f297ad5b5b",
            "value": "056b0657b5c3f9ff911f16baf8ca183b3c797b2c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633243",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6b680e8f-9359-44f5-8ed3-c24bb5833bd0",
            "value": "b8b81af76163bdcc5b4f7d8fe6795f164991f8a62678c971db031b9e90a27813",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "text",
            "timestamp": "1785632844",
            "to_ids": false,
            "type": "text",
            "uuid": "0b9a6f25-b28a-405e-a37c-3be3a158d5af",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 7/75\nFirst Submission: 2026-07-28T22:13:12+00:00\nLast Submission: 2026-07-28T22:13:12+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632844",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fc5f8632-f610-4a76-8079-1e1edda3f4a1",
            "value": "49152:tFhguMwOgAnnnqWLPjVJuf2Bo85k4BEaeXuFujENUjMQmKCn2ixSWV4HPGuVhWJj:ZZM+YVJPBruIrxSWe2l5+8HNX"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632844",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d09f6c52-a309-4211-8234-5c576356784b",
            "value": "5818024"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632844",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ae4adb30-97e1-4ce1-a477-4b739bb38345",
            "value": "d25565799e681f87d893246be3ad1ab0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-28T22:13:12+00:00",
            "last_seen": "2026-07-28T22:13:12+00:00",
            "object_relation": "filename",
            "timestamp": "1785632844",
            "to_ids": true,
            "type": "filename",
            "uuid": "15ade6b0-1e6b-47b8-b6c2-bbe4b1feb78d",
            "value": "aone-cli"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-04-22T12:32:43+00:00",
        "last_seen": "2026-04-22T12:32:43+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642823",
        "uuid": "7e0c08b5-35e7-45bc-b4b3-6e8d837165a8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "md5",
            "timestamp": "1785642823",
            "to_ids": true,
            "type": "md5",
            "uuid": "4a1373c6-65b5-4ad4-8122-ff86edd552d4",
            "value": "30e78dabe836bbc8e4cb313acd8e1274",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633244",
            "to_ids": true,
            "type": "sha1",
            "uuid": "323d9ba4-119b-4c4b-ac8a-293d3347a77a",
            "value": "00428ec4ffd919fb3df2fed765637eb074016f86",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633244",
            "to_ids": true,
            "type": "sha256",
            "uuid": "95d92028-6c4b-4b9c-8b29-8f9ea51ca40b",
            "value": "ef9a1896eeaae929800eade768276e2240ef252d26d0d96c1950a1a5e1aadb34",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "text",
            "timestamp": "1785632865",
            "to_ids": false,
            "type": "text",
            "uuid": "0fb6b59a-7ba0-4924-ac33-d99739825b38",
            "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/75\nFirst Submission: 2026-04-22T12:32:43+00:00\nLast Submission: 2026-04-22T12:32:43+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632865",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ff2c10f9-3044-44ca-8761-91445e115ffa",
            "value": "786432:0z3gh8pu9ZDqlXPze3kgg111Ph0qzMuqa+PJBo+duWF:0z3jykPze3kT111LRqhBjsWF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632865",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3fd55e7a-b6ed-4f43-a81e-60c02074eb04",
            "value": "39986579"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-04-22T12:32:43+00:00",
            "last_seen": "2026-04-22T12:32:43+00:00",
            "object_relation": "filename",
            "timestamp": "1785632865",
            "to_ids": true,
            "type": "filename",
            "uuid": "fd13de7b-d7ac-403f-bcf3-1420453327f8",
            "value": "app.asar"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-29T10:37:05+00:00",
        "last_seen": "2026-07-29T10:37:05+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642844",
        "uuid": "3cfcfdd5-6c8c-4c24-a9f4-4194ddc871a4",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "md5",
            "timestamp": "1785642844",
            "to_ids": true,
            "type": "md5",
            "uuid": "59d69839-917a-4e66-9086-f1569bc043f8",
            "value": "44a1709f7cb0f6668d0458b7f6cfa563",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633245",
            "to_ids": true,
            "type": "sha1",
            "uuid": "24be8113-00ef-4e1a-844c-7b422d748710",
            "value": "93f5ffae883f816005ced051c186bdc28baa8b82",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633245",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d54a3da8-3877-4a29-8c0a-3719e145d157",
            "value": "e5d8350f1540fe91145dc262c455bca7748ad97dafb2d9facd5adebed9f66d2d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "text",
            "timestamp": "1785632887",
            "to_ids": false,
            "type": "text",
            "uuid": "f71129db-946e-49eb-bb75-8b61ceda83ae",
            "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 3/75\nFirst Submission: 2026-07-29T10:37:05+00:00\nLast Submission: 2026-07-29T10:37:05+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632887",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7c07ff45-5f23-411c-9b50-55d8f05daaeb",
            "value": "12288:V6yFlvmqdUKOnlPgWsn4I8ZrnwsNqXtJ/FelS3tryGYbrlMnOCDED:V6y/uGUKOdM4lZr9qB9KhknDu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632887",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c37f229e-e884-47c4-a9c1-f6f9f569fff8",
            "value": "562320"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632887",
            "to_ids": true,
            "type": "vhash",
            "uuid": "59265fcc-39c3-477b-ba8d-921014e0c168",
            "value": "eb02dc9d8a5bb6cdf7cd4a1479c73265"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-29T10:37:05+00:00",
            "last_seen": "2026-07-29T10:37:05+00:00",
            "object_relation": "filename",
            "timestamp": "1785632887",
            "to_ids": true,
            "type": "filename",
            "uuid": "c7342823-c42e-468a-8edc-aa089731c2c2",
            "value": "aone-cli-deps.tar.gz"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-22T11:40:51+00:00",
        "last_seen": "2026-07-22T11:40:51+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642865",
        "uuid": "6aee9007-9310-4830-bdaa-e65c2b35d54a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "md5",
            "timestamp": "1785642865",
            "to_ids": true,
            "type": "md5",
            "uuid": "ce4ce3c4-9f6f-4622-8b6d-afee5c2b0ae1",
            "value": "56a65394c7db4686c2ce9f20dda32d45",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633247",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d6997fde-4ca2-40e5-96b2-0bae992790a5",
            "value": "00dcd2ceb78f9691c47938642c30057fa8ca46fd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633247",
            "to_ids": true,
            "type": "sha256",
            "uuid": "404473e4-7672-4833-aaf7-d44a189f5e8e",
            "value": "41957bd0ba2d9c07af2e069f10780fdf6b2102c065bebe0db2136dfe07d67a28",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "text",
            "timestamp": "1785632909",
            "to_ids": false,
            "type": "text",
            "uuid": "ca150b3c-984c-41f2-8a14-9535fe78a88a",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/AoneHijack.LFX!MTB\nClamAV: None\nVT Total Detection: 6/75\nFirst Submission: 2026-07-22T11:40:51+00:00\nLast Submission: 2026-07-22T11:40:51+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632909",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "044adca9-403e-4920-87f6-3f42145e8b4f",
            "value": "192:AuPlL78JBKfttX1rR7LD9pGm9s4riQ2H8JBeqQaC/SwiFKy8a6yVXE0rihDHllFg:A4lCK3bOzhiFD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632909",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "bde38ef0-2375-4d45-bb99-2e751463cf07",
            "value": "14417"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632909",
            "to_ids": true,
            "type": "vhash",
            "uuid": "59879c48-b355-4c20-9930-0ba0f7ba42bf",
            "value": "78411eb9e688ead4c4f84df7d7381562"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-22T11:40:51+00:00",
            "last_seen": "2026-07-22T11:40:51+00:00",
            "object_relation": "filename",
            "timestamp": "1785632909",
            "to_ids": true,
            "type": "filename",
            "uuid": "1424f6e7-76c6-4372-b160-c56d9f3135de",
            "value": "crypto.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-29T12:21:18+00:00",
        "last_seen": "2026-07-29T12:21:18+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785642886",
        "uuid": "1b4f0c4f-2965-4ddb-8763-1e0665474c37",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "md5",
            "timestamp": "1785642886",
            "to_ids": true,
            "type": "md5",
            "uuid": "2130293e-128c-4035-9faa-0210a1cf211d",
            "value": "88f8eb057a01781b7ef39dc1d929a34f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633247",
            "to_ids": true,
            "type": "sha1",
            "uuid": "76a99b1c-2b05-481d-8402-27bb343fcf7c",
            "value": "c878612e2330ed0dfdf804c1bece5e79aef3c717",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633248",
            "to_ids": true,
            "type": "sha256",
            "uuid": "166a1a31-77fa-4a60-9e1a-9240e390ebd5",
            "value": "33b58598eb317553942e27545982d4c25ce6120eae10e42393746eb0e02ecae9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "text",
            "timestamp": "1785632930",
            "to_ids": false,
            "type": "text",
            "uuid": "2dd864e3-066e-46e6-9360-78228b3046d7",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.C!ml\nClamAV: None\nVT Total Detection: 3/75\nFirst Submission: 2026-07-29T12:21:18+00:00\nLast Submission: 2026-07-29T12:21:18+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785632930",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "efcbad35-fb66-49f4-966e-9957d415e03d",
            "value": "49152:FRxnJB2UytHA6imeSX+zA/k3C6JgQXd16r2kcuogzJbzgeBQMZLj4GlSzowjh0li:J3WipzAMRw4tv/5+/VLnu"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785632930",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "dbe2d0c9-7d5c-4324-8b7c-5a4042ad3fdb",
            "value": "5818024"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "vhash",
            "timestamp": "1785632930",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d463f8a2-0a2d-4414-99d0-53c16404d928",
            "value": "d25565799e681f87d893246be3ad1ab0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-29T12:21:18+00:00",
            "last_seen": "2026-07-29T12:21:18+00:00",
            "object_relation": "filename",
            "timestamp": "1785632930",
            "to_ids": true,
            "type": "filename",
            "uuid": "fdfda981-5854-4726-b1e2-f2c73e99d247",
            "value": "aone-kit-update"
          }
        ]
      }
    ]
  }
}