{
  "Event": {
    "analysis": "1",
    "date": "2026-06-24",
    "extends_uuid": "",
    "info": "[Threat Intel] LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign",
    "protected": false,
    "publish_timestamp": "1782538731",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782535849",
    "uuid": "fa49e065-1823-412e-b56f-ef8274449f34",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"LokiBot\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442814",
        "to_ids": false,
        "type": "link",
        "uuid": "dde93040-2865-4a4a-803f-a345684b8202",
        "value": "https://www.levelblue.com/blogs/spiderlabs-blog/lokibot-after-a-decade-an-analysis-of-a-recent-lokibot-campaign"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442814",
        "to_ids": false,
        "type": "text",
        "uuid": "90c767df-3dc9-4570-ba53-edfccb094d47",
        "value": "LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442814",
        "to_ids": false,
        "type": "text",
        "uuid": "148002fd-2061-488f-a482-c740ca22ddc9",
        "value": "Name: LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"credential theft\", \"malspam\", \"infostealer\", \"lokibot\", \"multi-stage\"]\nTgtd countries: []\nMlwr families: [\"Lokibot - S0447\"]\nAttack_ids: [\"T1056.001\", \"T1539\", \"T1566.001\", \"T1082\", \"T1106\", \"T1555\", \"T1036\", \"T1083\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1055.012\", \"T1027\", \"T1573\", \"T1027.002\", \"T1071.001\", \"T1059.005\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782469086",
        "to_ids": true,
        "type": "domain",
        "uuid": "0a84519b-4720-4540-ae50-df5eb4018fc6",
        "value": "alphastand.trade",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782469109",
        "to_ids": true,
        "type": "domain",
        "uuid": "b2e2a9e9-4335-4c27-8b41-ddcdc0247ec0",
        "value": "alphastand.win",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782469130",
        "to_ids": true,
        "type": "domain",
        "uuid": "de53adce-19dc-4986-8831-adfb6704c3c1",
        "value": "alphastand.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524237",
        "to_ids": true,
        "type": "url",
        "uuid": "424333d3-13ea-4d24-8f37-acb0aeb2376f",
        "value": "http://alphastand.top/alien/fre.php",
        "Tag": [
          {
            "colour": "#81bddc",
            "local": false,
            "name": "QuotaExceededError",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524260",
        "to_ids": true,
        "type": "url",
        "uuid": "8a02938d-6bfd-47b2-a482-fa0cac4e7204",
        "value": "http://alphastand.trade/alien/fre.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524282",
        "to_ids": true,
        "type": "url",
        "uuid": "f1153acd-6a55-45f2-8631-8ae34d8a4831",
        "value": "http://alphastand.win/alien/fre.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524305",
        "to_ids": true,
        "type": "url",
        "uuid": "bd45228a-bc4c-431a-8ad2-b1ea5ac17dbb",
        "value": "http://kbfvzoboss.bid/alien/fre.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524326",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e94cb697-e9d5-4cc6-92ed-b83d53434949",
        "value": "158.94.211.95",
        "Tag": [
          {
            "colour": "#ce048f",
            "local": false,
            "name": "asn:asn=\"209800\"",
            "relationship_type": ""
          },
          {
            "colour": "#434f78",
            "local": false,
            "name": "asn:as-owner=\"METASPINNER-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524344",
        "to_ids": true,
        "type": "url",
        "uuid": "94b57659-1202-4fcc-abca-49235eae5b40",
        "value": "http://158.94.211.95/kelly/five/fre.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442814",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "02fdd3ea-ab66-4a7f-b171-1c92338d60f3",
        "value": "CVE-2026-24190"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782467539",
        "to_ids": true,
        "type": "sha256",
        "uuid": "53855cab-f178-4249-b793-d28fd7d4b50d",
        "value": "ad10ff9043d6f327045943635fcbd0c5918acb79dc998db92ee4c7dee5224710",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782524368",
        "to_ids": true,
        "type": "domain",
        "uuid": "0010fe66-e434-4442-a765-574d43d78f8d",
        "value": "kbfvzoboss.bid",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782524389",
        "uuid": "9d10718c-7d77-4eab-b238-862bce50eb13",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782524389",
            "to_ids": true,
            "type": "md5",
            "uuid": "0faeb804-f9a8-439e-9c1e-b078a2542aed",
            "value": "a484efb02ab3c049666af91363bfdf77",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467529",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5dfbe38a-ccd5-4248-b845-57297d35a6f6",
            "value": "c44ec9336ed67352ee021097876a82407c40eea1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467529",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4d44f527-3950-4435-b599-5ba447f07598",
            "value": "c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467277",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "299047df-0230-4fa6-9068-19749bdec974",
            "value": "12288:0/45LG8tVgfIJA3k8jNWl/u79SJ6eb/lbcIRDQNoSEx5a9NWvGo/TIS3BQ3XR+NY:Q4dGogYceh5Z+o/5uu/t6rRvT"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467277",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "52de858a-9149-4d1b-b581-eda653a21a06",
            "value": "1128383"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467277",
            "to_ids": true,
            "type": "filename",
            "uuid": "767f672b-120c-4f60-ba23-a58b21daf3bc",
            "value": "c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467277",
            "to_ids": false,
            "type": "text",
            "uuid": "8fc843ee-6540-4fc7-86d2-37d64decbb52",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:29/60\nFirst Submission:2026-05-07T16:34:18.000000+00:00\nLast Submission:2026-05-07T18:45:45.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782524983",
        "uuid": "c193cb51-4ee7-43dc-9685-67f7fc466fa8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782524983",
            "to_ids": true,
            "type": "md5",
            "uuid": "8dc22086-c35f-4aab-9623-028950e34681",
            "value": "1c5a2971f63fa7e5d92f12576c62ef98",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#669ae5",
                "local": false,
                "name": "AlreadyExistsError",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467532",
            "to_ids": true,
            "type": "sha1",
            "uuid": "29c5b10c-b56f-4ee9-864e-72629c058af6",
            "value": "dbd06b5eee4f0a5441f21a8d815e39d47857adeb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467532",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4c14aead-ac2e-49ea-a0aa-324148ef387b",
            "value": "64c7dd0a3a3ae49977ac05913d3878000cce14e5d8c1ee05b782bdfd648bde91",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467301",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4d985958-6e9d-4b5b-8992-890436fb2351",
            "value": "12288:VAKIB7GsLfVZ1c04XcCEUsfEGVUwh4E69/oXK8hW4oB:VAKIZHUICEDfEGVfCB"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467301",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fe1c1857-9560-47f0-b876-6ce5527cbf45",
            "value": "799601"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467301",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cd99ddc9-a0f3-4420-bb1d-d50e8a2ddee7",
            "value": "ac34ce5e0553d41dfe6fdb4c6d79a6dd"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467301",
            "to_ids": true,
            "type": "filename",
            "uuid": "05f32bdc-9cdc-462d-a33b-d63129baa02f",
            "value": "ps_4Q3rCxsQt9yj_1782337454233.ps1"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467301",
            "to_ids": false,
            "type": "text",
            "uuid": "657fe6b2-6511-4447-b724-0eb1c3375b87",
            "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Obfuse.SGI!MTB\nVT Total Detection:9/61\nFirst Submission:2026-06-24T14:48:26.000000+00:00\nLast Submission:2026-06-24T14:48:26.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782525004",
        "uuid": "42174083-e268-4e74-a891-1fdbec5a52a3",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782525004",
            "to_ids": true,
            "type": "md5",
            "uuid": "333355da-4659-4550-b4d9-f251c22cfce7",
            "value": "db02982d66b3c503cedda93c15de589d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467534",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7306e09a-2706-4ac7-a712-bb3a192a9a8a",
            "value": "67c85727da532d612d4a098a8c8438c0d153db6f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467534",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b94ab12f-c9f8-4d15-94ab-9f157629070b",
            "value": "4c9f271242f61f1a31b8146305e9a7ed512c521445d4f7a7a901e301307add3d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467348",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "bfe93e31-69f2-4e89-ba9b-6658da32d453",
            "value": "384:cBnljXajyJxDZmt2AGVJtZoflwUXpuAFUOUcf7SfwS6WNws:cBlDajyHDct2xoiUXYiUNcf7ew"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467348",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e3657d70-f6e1-4307-adfa-df68b5308cc5",
            "value": "24064"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467348",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9f8af988-3ef0-4073-bd03-44ec5044ec00",
            "value": "32403655151e082510020"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467348",
            "to_ids": true,
            "type": "filename",
            "uuid": "3624bfbf-49d9-463f-965a-48b9d33982ff",
            "value": "MEN.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467348",
            "to_ids": false,
            "type": "text",
            "uuid": "22b8f1b2-72f7-49fe-a327-d84becd17237",
            "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:MSIL/Heracles!MTB\nVT Total Detection:47/70\nFirst Submission:2026-05-07T07:40:56.000000+00:00\nLast Submission:2026-05-07T07:40:56.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782525025",
        "uuid": "6a36a54b-fac2-4fbb-aaca-24dcf2b9d452",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782525025",
            "to_ids": true,
            "type": "md5",
            "uuid": "a6b8e9f7-3c1d-4583-877d-233590330a49",
            "value": "77b39d9e5463f65a1bc213d3a300a55c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782467537",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8e839e53-b04c-4313-8c10-11381d78036a",
            "value": "427fe47d054afd7cdb16090227650b5497530e6d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782467537",
            "to_ids": true,
            "type": "sha256",
            "uuid": "614079da-e7f6-4d94-9b46-6019e9b34015",
            "value": "5864a697bd7b339f56b05405f29a097cd027cafdcc4e63c2aaeccccbf930605f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782467372",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "61539b2a-ad38-47fb-872f-fc98ad302663",
            "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782467372",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "94b936e4-0552-41ca-ae33-04bc3f12f666",
            "value": "106496"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782467372",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e43598e7-d69a-4e66-a034-b4f9fc55f89e",
            "value": "015046651d1c1bz57z303jz87z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782467372",
            "to_ids": true,
            "type": "filename",
            "uuid": "f9bea946-0a9d-448f-9031-417bfabca8c7",
            "value": "iytt06.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782467372",
            "to_ids": false,
            "type": "text",
            "uuid": "2fcd8eb2-7260-423e-86e3-3945fbbb3e70",
            "value": "Type Description: Win32 EXE\nMicrosoft: PWS:Win32/PrimaryPass!pz\nVT Total Detection:65/70\nFirst Submission:2026-03-26T22:03:24.000000+00:00\nLast Submission:2026-03-26T23:07:06.000000+00:00"
          }
        ]
      }
    ]
  }
}