{
  "Event": {
    "analysis": "1",
    "date": "2026-07-24",
    "extends_uuid": "",
    "info": "[Threat Intel] June 2026 Threat Trend Report on APT Attacks (South Korea)",
    "protected": false,
    "publish_timestamp": "1785616357",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785616356",
    "uuid": "e988439f-6259-434c-9940-18845326703e",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#bb889f",
        "local": false,
        "name": "misp-galaxy:producer=\"AhnLab\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e1e63b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#150050",
        "local": false,
        "name": "rectifyq:sub-category=\"report\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"South Korea\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784948414",
        "to_ids": false,
        "type": "link",
        "uuid": "03675573-c628-4a84-a2c5-88a76ca6bb10",
        "value": "https://asec.ahnlab.com/en/94594/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784948414",
        "to_ids": false,
        "type": "text",
        "uuid": "4c260ec1-99f0-4fe9-9ea5-9e6130f5e72b",
        "value": "AhnLab monitored Advanced Persistent Threat attacks targeting South Korea during June 2026, identifying multiple attack types distributed primarily through spear phishing campaigns. Threat actors disguised malicious files as work-related documents, with LNK files being the most common delivery method. Six distinct attack types were observed, employing various techniques including malicious PowerShell commands, AutoIt malware, curl.exe abuse, GitHub repository exploitation, Task Scheduler persistence, DLL side-loading, and Python backdoors. These attacks deployed Infostealers, keyloggers, backdoors, and remote access tools like XenoRAT. Once executed, the malware established persistence, exfiltrated system information, and enabled remote control of compromised systems. Organizations are advised to verify email senders, avoid opening files from unknown sources, apply security patches, and maintain updated antivirus software to mitigate these persistent threats."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784948414",
        "to_ids": false,
        "type": "text",
        "uuid": "bff4441e-8806-4345-888e-9d4f4535316a",
        "value": "Name: June 2026 Threat Trend Report on APT Attacks (South Korea)\nAuthor: AlienVault\nAdversary: Kimsuky\nTags: [\"xenorat\", \"autoit\", \"task scheduler\", \"spear phishing\", \"apt\", \"pebbledash\", \"prxclient\", \"kimsuky\", \"github abuse\", \"powershell\", \"south korea\", \"lnk files\"]\nTgtd countries: []\nMlwr families: [\"AutoIt backdoor - S0129\", \"XenoRAT\", \"PebbleDash\", \"PrxClient\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1056.001\", \"T1204.002\", \"T1566.001\", \"T1082\", \"T1140\", \"T1036\", \"T1055\", \"T1218.005\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1059.006\", \"T1059.003\", \"T1071.001\", \"T1574.002\", \"T1105\", \"T1102.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784948414",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "db436002-5038-4cf2-b7ef-2910fd560056",
        "value": "Kimsuky"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600925",
        "to_ids": true,
        "type": "md5",
        "uuid": "0b7c36f3-2cb8-47eb-9167-e09e1d592ce1",
        "value": "03e4bef86f3e3e6ea23eb6f017af0c98",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600926",
        "to_ids": true,
        "type": "md5",
        "uuid": "c38c0acd-2f89-409a-a9e1-e063a3bf63be",
        "value": "07bb21d28ae4ab07d62f8deb4343aaeb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600927",
        "to_ids": true,
        "type": "md5",
        "uuid": "20b5b9cf-6503-4edc-92f1-c31d535d3fc8",
        "value": "0b1de625a89da12bd1fdd292b341bad3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601758",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa8b4bdc-621c-4e9c-81bf-bbc8a3d7f365",
        "value": "bohyeonsanvil.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601779",
        "to_ids": true,
        "type": "domain",
        "uuid": "e6b1e84d-b734-4482-93e0-cbabdc9a6020",
        "value": "kumhosports.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601801",
        "to_ids": true,
        "type": "url",
        "uuid": "b1a03c38-6670-4b49-8960-db8a9567bd71",
        "value": "http://bohyeonsanvil.com/board/board_file/viewer.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601822",
        "to_ids": true,
        "type": "url",
        "uuid": "86bb911e-1fdb-40fd-b08d-fc90410e3684",
        "value": "http://bohyeonsanvil.com/board/board_file/viewer.php?mode=5jbpdhNK85H5IZHnD91CG&data=o4mSj3SGUxz8pejDQ4k7FzKYA34jcpiWGtI",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601843",
        "to_ids": true,
        "type": "url",
        "uuid": "fd769ab5-019c-40fd-9e6a-c47624747636",
        "value": "http://kumhosports.com/inc/logquery.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601864",
        "to_ids": true,
        "type": "url",
        "uuid": "c366f205-3696-4955-9c5f-b4b9f55d1cc7",
        "value": "http://kumhosports.com/inc/logquery.php?query=0KuKue2Ml2EDsY4vH&number=8S0ozy6bPeRjjBHC5Kjr7JpIMu81sZIe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601885",
        "to_ids": true,
        "type": "url",
        "uuid": "1ac4c409-0ea4-41c2-ad1c-5f1da03836c4",
        "value": "http://kumhosports.com/inc/logquery.php?query=JeNVJ4a0hubZI2ZKuH7jd&number=l1A0DxsG9hpYYauqBM5aSVXKhf3E1PNRFKO",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-04T03:03:51+00:00",
        "last_seen": "2026-07-04T03:03:51+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785601906",
        "uuid": "2c78fffc-402b-446e-a123-cdcc82b40c88",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "md5",
            "timestamp": "1785601906",
            "to_ids": true,
            "type": "md5",
            "uuid": "e8e3965e-db4a-4127-8779-bcbebc7a2691",
            "value": "05c07339603994b36dcfefcce720d03d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "sha1",
            "timestamp": "1785600922",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0ffbaab7-11dd-4994-8dec-735f63b46da6",
            "value": "f27a402a1a15684cf3c973d1ee263552f7125b8d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "sha256",
            "timestamp": "1785600922",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b2e273c4-014f-4a8c-80eb-8ad88fe3b0e5",
            "value": "9529cfa547d2008ff4ba156e9a4ec2b209122fafee073217b8c2db48edfde4b0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 24/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "text",
            "timestamp": "1785600108",
            "to_ids": false,
            "type": "text",
            "uuid": "962a24a2-090e-42eb-a784-056535e51715",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/WinLNK!AMTB\nClamAV: None\nVT Total Detection: 36/74\nFirst Submission: 2026-07-04T03:03:51+00:00\nLast Submission: 2026-07-04T03:03:51+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "creation-time",
            "timestamp": "1785600108",
            "to_ids": false,
            "type": "datetime",
            "uuid": "55f62b5e-2f6a-455c-abe4-4b12b6fe16cc",
            "value": "2025-09-09T19:41:00+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785600108",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "c17d5c69-a46f-4e63-93c4-f8a8a25cd14f",
            "value": "24:8RraOrFN2AH3LKOYvWYfOS+AWVjXYjjjzfxcxnBf/u+/E4I0aduWXE+habhOOFCy:8ROGv3m+KBfx6xuAIzuWXEiajwYks"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785600108",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4508bdb4-6864-4b98-97fe-16edd06bf383",
            "value": "2581"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "vhash",
            "timestamp": "1785600108",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b19057ad-28ea-424a-b389-80831d47effb",
            "value": "17c8b63a48fd94810353efaaa0e138a1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-04T03:03:51+00:00",
            "last_seen": "2026-07-04T03:03:51+00:00",
            "object_relation": "filename",
            "timestamp": "1785600108",
            "to_ids": true,
            "type": "filename",
            "uuid": "8e58e352-5d39-4f60-9489-8c92bf47c2be",
            "value": "password.txt.lnk"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-10T02:43:21+00:00",
        "last_seen": "2026-06-10T02:43:21+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785601927",
        "uuid": "b9a54a28-5316-4aea-b080-037f72a7329d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "md5",
            "timestamp": "1785601927",
            "to_ids": true,
            "type": "md5",
            "uuid": "2fd188e9-37c6-41e8-8f67-d68ec2853c65",
            "value": "07ed2c9ed61b60078af0164f061696be",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "sha1",
            "timestamp": "1785600923",
            "to_ids": true,
            "type": "sha1",
            "uuid": "9a9b1ec8-020d-49ca-8eb4-694ad42bde34",
            "value": "3b24857386c2f322f4836790146abd6d35f3e496",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "sha256",
            "timestamp": "1785600924",
            "to_ids": true,
            "type": "sha256",
            "uuid": "95ded540-fe79-44b2-877f-58075a7d6c60",
            "value": "9088a5edf0ed38d5a571c86e8196f137b0c711fc2bf0bc4abe6bedef2ab54a4f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 28/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "text",
            "timestamp": "1785600150",
            "to_ids": false,
            "type": "text",
            "uuid": "48e314e3-4d1a-4056-8d2f-f12f50cd17a4",
            "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 36/75\nFirst Submission: 2026-06-10T02:43:21+00:00\nLast Submission: 2026-06-10T02:43:21+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "creation-time",
            "timestamp": "1785600150",
            "to_ids": false,
            "type": "datetime",
            "uuid": "e72661c7-e953-4b65-8a15-d9e0e38ef14c",
            "value": "2025-09-09T19:41:00+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785600150",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bcb5b7d7-12d1-4ca2-bd58-dc78ba8dce82",
            "value": "24:8RraOrFN2AH3LKOYvWYfOS+AWZhUQjjjjjj3hiTuI1ll+/E4I0aduWXE+habhOOn:8ROGv3m+K4Uwh+1/AIzuWXEiajwYks"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785600150",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fc262900-713e-44e3-ba1d-a44e9cb65b6f",
            "value": "2605"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "vhash",
            "timestamp": "1785600150",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cee94093-99d3-4fa3-ae0a-4344df1ba014",
            "value": "17c8b63a48fd94810353efaaa0e138a1"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-10T02:43:21+00:00",
            "last_seen": "2026-06-10T02:43:21+00:00",
            "object_relation": "filename",
            "timestamp": "1785600150",
            "to_ids": true,
            "type": "filename",
            "uuid": "980efe01-646c-4afa-9251-3f539349f5d4",
            "value": "\uc554\ud638.txt.lnk"
          }
        ]
      }
    ]
  }
}