{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 1,
      "deduplicated_iocs": 15,
      "direct_entities": 50,
      "direct_relationships": 49,
      "invalid_iocs": 0,
      "iocs": 15,
      "mentioned": 2,
      "mitre_associated": 2,
      "mitre_direct": 0,
      "targets": 2,
      "techniques": 0,
      "unsupported_indicators": 16,
      "vulnerabilities": 0
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 132,
      "excluded_graph_objects": 350,
      "graph_complete": true,
      "graph_objects": 50,
      "graph_relationships": 49,
      "mitre_context_complete": true,
      "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
      "status_as_of": "2026-10-10T20:26:06+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.212Z",
          "created_at": "2026-09-26T20:33:21.041Z",
          "modified": "2026-09-26T20:34:10.131Z",
          "updated_at": "2026-09-26T20:34:10.131Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--c2224c2e-6a3b-5d63-acc6-14dfaff315f9",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:32:58.695Z",
          "updated_at": "2026-09-26T20:32:59.185Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "0bc4a8ba-df16-4130-b37f-1aa7bdd387c7",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--5c9d1907-ca3a-5b52-8e57-a6cf7fb474be",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "indicator_types": [
            "url"
          ],
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.224Z",
          "created_at": "2026-09-26T20:33:23.872Z",
          "modified": "2026-09-28T16:54:54.460Z",
          "updated_at": "2026-09-28T16:54:54.460Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "1845229b-d72a-4cd3-82a7-51941fa308ef",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--44dfa291-a7b6-5e3c-ad5f-ca9f5a6287f1",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:10.840Z",
          "updated_at": "2026-09-26T20:33:11.245Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "18ecacfd-e2e7-4040-b64b-6d7361a96b25",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--41678111-36aa-5271-be47-475e94bf8333",
        "type": "Url"
      },
      {
        "__typename": "Malware",
        "aliases": [
          "1xxbot",
          "ArechClient",
          "win.sectop_rat"
        ],
        "attributes": {
          "is_family": true,
          "malware_types": [
            "bot"
          ]
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": {
          "authorized_members": [],
          "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a",
          "is_inferred": false,
          "name": "Malpedia",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2026-01-18T17:45:16.574Z",
          "created_at": "2026-01-18T17:45:44.962Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-10-07T03:24:05.105Z",
          "updated_at": "2026-10-07T03:24:05.105Z"
        },
        "description_available": true,
        "entity_type": "Malware",
        "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "is_inferred": false,
        "labels": [
          "as216071",
          "botnet_cc",
          "c2",
          "censys",
          "rat",
          "sectop",
          "vdsina"
        ],
        "lang": "en",
        "name": "SectopRAT",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": null,
            "id": "1f63d842-92bb-4b98-8f1f-a8a295334f6f",
            "source_name": "alien-vault",
            "url": "https://www.recordedfuture.com/research/graycharlie-hijacks-law-firm-sites-suspected-supply-chain-attack"
          },
          {
            "external_id": null,
            "id": "3a386a0a-a61e-4840-8d91-1d7aafce6263",
            "source_name": "malpedia",
            "url": "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/"
          },
          {
            "external_id": null,
            "id": "8efc7aeb-eeb9-4e2a-be40-e41b6d8eda8d",
            "source_name": "malpedia",
            "url": "https://cdn-production.blackpointcyber.com/wp-content/uploads/2022/11/01161208/Blackpoint-Cyber-Ratting-out-Arechclient2-Whitepaper.pdf"
          },
          {
            "external_id": null,
            "id": "d758714a-78b2-4b60-9b89-6587ee3331aa",
            "source_name": "malpedia",
            "url": "https://cyberflorida.org/2022/11/arechclient2/"
          },
          {
            "external_id": null,
            "id": "1effdcb9-9c7e-4435-93dd-999b0d199f54",
            "source_name": "malpedia",
            "url": "https://dr4k0nia.github.io/posts/Analysing-a-sample-of-ArechClient2/"
          },
          {
            "external_id": null,
            "id": "ccdab869-0c8e-4bec-9388-c0cf11a22c1e",
            "source_name": "malpedia",
            "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat"
          },
          {
            "external_id": null,
            "id": "62710fb1-c4f2-4eec-a662-425e56250b76",
            "source_name": "malpedia",
            "url": "https://medium.com/@gi7w0rm/a-long-way-to-sectoprat-eb2f0aad6ec8"
          },
          {
            "external_id": null,
            "id": "e41dd644-7fe2-4b80-914e-b724923aa916",
            "source_name": "malpedia",
            "url": "https://medium.com/@joshuapenny88/hostinghunter-series-chang-way-technologies-co-limited-a9ba4fce0f65"
          },
          {
            "external_id": null,
            "id": "528a245f-1944-46ca-9352-fb2eb04fec90",
            "source_name": "malpedia",
            "url": "https://medium.com/@sarviyamalwareanalyst/sectoprat-a-dangerous-remote-access-trojan-spreading-through-google-fake-ads-0c43a15c1cd8"
          },
          {
            "external_id": null,
            "id": "63e6fab8-1015-46f6-9907-54a1eba5a3ad",
            "source_name": "malpedia",
            "url": "https://medium.com/walmartglobaltech/arechclient-decoding-iocs-and-finding-the-onboard-browser-extension-477f8796568d"
          },
          {
            "external_id": null,
            "id": "c2f6967a-3c59-4da9-aaf9-0f68eabe09f2",
            "source_name": "malpedia",
            "url": "https://tampabay.tech/2022/11/30/arechclient2/"
          },
          {
            "external_id": null,
            "id": "9a4a17bb-c8f9-4314-88c8-14b6e7edc6c3",
            "source_name": "malpedia",
            "url": "https://vxhive.blogspot.com/2021/01/deep-dive-into-sectoprat.html"
          },
          {
            "external_id": null,
            "id": "c84c0213-93ce-41de-ad4e-cdd0e10c2de0",
            "source_name": "malpedia",
            "url": "https://www.cisecurity.org/insights/blog/top-10-malware-march-2022"
          },
          {
            "external_id": null,
            "id": "88b6fa52-727f-469e-9766-b968a0f74811",
            "source_name": "malpedia",
            "url": "https://www.elastic.co/security-labs/a-wretch-client"
          },
          {
            "external_id": null,
            "id": "7812be83-4306-4338-add7-17d21fe13f90",
            "source_name": "malpedia",
            "url": "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
          },
          {
            "external_id": null,
            "id": "f9e70eda-5bf9-495e-9586-83dfc3a5b2a8",
            "source_name": "malpedia",
            "url": "https://www.gdatasoftware.com/blog/2019/11/35548-new-sectoprat-remote-access-malware-utilizes-second-desktop-to-control-browsers"
          },
          {
            "external_id": null,
            "id": "703b3c5f-fddc-445b-b22b-50c905477cb7",
            "source_name": "malpedia",
            "url": "https://www.gdatasoftware.com/blog/2021/02/36633-new-version-adds-encrypted-communication"
          },
          {
            "external_id": null,
            "id": "84a20d4a-2f51-477d-93ef-1567290b9e48",
            "source_name": "malpedia",
            "url": "https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat"
          },
          {
            "external_id": null,
            "id": "cd0674b0-42f2-4200-a169-050a5566f0d7",
            "source_name": "malpedia",
            "url": "https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/"
          },
          {
            "external_id": null,
            "id": "f9a9cf10-8bb1-4bdd-91bd-68d6148b6cdc",
            "source_name": "malpedia",
            "url": "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "malware--66747fba-6971-5200-bd97-d10c9493a2eb",
        "type": "Malware"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.217Z",
          "created_at": "2026-09-26T20:33:21.923Z",
          "modified": "2026-09-26T20:34:15.421Z",
          "updated_at": "2026-09-26T20:34:15.421Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--c923a9e2-b888-5ddf-95be-d65c8db400c3",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.237Z",
          "created_at": "2026-09-26T20:33:27.973Z",
          "modified": "2026-09-26T20:35:29.045Z",
          "updated_at": "2026-09-26T20:35:29.045Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "212077e5-8ea5-42ec-8dc4-2e5434335640",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--1b40c14e-4dd7-5e89-9bec-aed9a1b0b882",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.205Z",
          "created_at": "2026-09-26T20:33:19.573Z",
          "modified": "2026-09-26T20:34:06.279Z",
          "updated_at": "2026-09-26T20:34:06.279Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "2211752f-91b9-42ef-ade7-600155196ac3",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--a8bc0e84-2379-5207-bd7a-077a409e58b3",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.210Z",
          "created_at": "2026-09-26T20:33:20.263Z",
          "modified": "2026-09-26T20:34:08.381Z",
          "updated_at": "2026-09-26T20:34:08.381Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--8e64679e-5220-52e4-97c3-62b141446e20",
        "type": "Indicator"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Bitcoin",
          "Crypto",
          "Cryptocurrency",
          "Currency Exchange",
          "IT",
          "Information Security",
          "Software Development",
          "Technology",
          "Virtual Currency",
          "Vulnerability Research",
          "software"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.394Z",
          "created_at": "2026-01-18T14:35:11.762Z",
          "modified": "2026-03-09T09:41:22.635Z",
          "updated_at": "2026-03-09T09:41:22.635Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Technologies",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad",
        "type": "Sector"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:09.797Z",
          "updated_at": "2026-09-28T16:54:53.016Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "2cbaf03d-6389-4692-b7e5-c5bcea45e8b2",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--7ab4640c-9eb3-5214-8051-95a4c81b55ed",
        "type": "Url"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:03.427Z",
          "updated_at": "2026-09-26T20:33:05.073Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "3bf6cd1e-a991-42e3-a00f-66173694950d",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "file--a124abf3-d67c-5b5a-aa1f-f7aebb31a387",
        "type": "StixFile"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:09.790Z",
          "updated_at": "2026-09-26T20:33:10.209Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "43bd74e7-6b62-4ceb-b175-b4a5567a7d8c",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--618e3135-2d73-574b-9f75-8b272b4eefff",
        "type": "Url"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:10.154Z",
          "updated_at": "2026-09-26T20:33:10.769Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "4865ce19-0ef6-49a0-824e-0e1126e4f966",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--f825d2a6-650e-5a5a-a9ef-9824da8d4262",
        "type": "Url"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:01.661Z",
          "updated_at": "2026-09-26T20:33:02.152Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "4bceb86b-61fd-4193-8670-648b37bf5b0e",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--899478f3-9c1a-5b90-9ef6-be9bb0888590",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.222Z",
          "created_at": "2026-09-26T20:33:23.553Z",
          "modified": "2026-09-26T20:34:21.064Z",
          "updated_at": "2026-09-26T20:34:21.064Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "4c1469d2-62d9-451b-8616-68c4865aade9",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--7ae2502d-9d17-5a31-b9f8-2b6b38be6e3d",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:02.129Z",
          "updated_at": "2026-09-26T20:33:02.593Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "4da84bf2-4e47-4ed2-8187-1e97193b2962",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "file--42799b2a-e0e7-55db-8a89-c18caf51b863",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.235Z",
          "created_at": "2026-09-26T20:33:27.664Z",
          "modified": "2026-09-26T20:35:15.974Z",
          "updated_at": "2026-09-26T20:35:15.974Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--a62c8be8-4f05-5d13-a4cb-ceca8b4f2371",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.198Z",
          "created_at": "2026-09-26T20:33:15.781Z",
          "modified": "2026-09-26T20:34:02.373Z",
          "updated_at": "2026-09-26T20:34:02.373Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "5355250c-998a-41c9-a224-7662e0f5ecb4",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--c7958dbf-9d6f-5626-821c-7b3db251941b",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.229Z",
          "created_at": "2026-09-26T20:33:25.590Z",
          "modified": "2026-09-26T20:34:27.133Z",
          "updated_at": "2026-09-26T20:34:27.133Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "53710c19-eb34-4051-85a4-3397cce04f5b",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--867414f9-e0a7-5edc-8f53-f08506fc6b9a",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.191Z",
          "created_at": "2026-09-26T20:33:13.165Z",
          "modified": "2026-09-26T20:33:43.652Z",
          "updated_at": "2026-09-26T20:33:43.652Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "5681fd55-0ee6-4d34-b32b-ec3fa559a8da",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--caa9a68c-345c-5f35-b633-02b35bb39ea6",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.227Z",
          "created_at": "2026-09-26T20:33:24.175Z",
          "modified": "2026-09-26T20:34:22.603Z",
          "updated_at": "2026-09-26T20:34:22.603Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--d306fd41-9209-5d51-875c-a9afe17832e4",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.242Z",
          "created_at": "2026-09-26T20:33:29.289Z",
          "modified": "2026-09-26T20:35:35.643Z",
          "updated_at": "2026-09-26T20:35:35.643Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--e9f8de86-4e38-5cd4-8ef7-70a1e812efaa",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.219Z",
          "created_at": "2026-09-26T20:33:22.754Z",
          "modified": "2026-09-26T20:34:17.221Z",
          "updated_at": "2026-09-26T20:34:17.221Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--cb068067-25ca-5bfd-9286-2c01f4dcc650",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:04.039Z",
          "updated_at": "2026-09-26T20:33:07.898Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "68f78078-e0e9-4336-b288-d743ae45315a",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "file--5d5e895f-da12-5840-ab96-3f1aa636607a",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.207Z",
          "created_at": "2026-09-26T20:33:19.990Z",
          "modified": "2026-09-26T20:34:08.120Z",
          "updated_at": "2026-09-26T20:34:08.120Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "6c0ba0e6-2a4f-4b76-9dd6-f87148d3eb4b",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--4373ee8f-e61e-54ae-8541-5a37d757e2d2",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:01.020Z",
          "updated_at": "2026-09-26T20:33:01.373Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "6d0c5479-b088-4dc8-9b33-2735094a1b4a",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--f5affea7-94a6-5eb6-99d2-e5bb1e4b92ce",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.201Z",
          "created_at": "2026-09-26T20:33:17.320Z",
          "modified": "2026-09-26T20:34:03.493Z",
          "updated_at": "2026-09-26T20:34:03.493Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "7098b0da-a0a3-4e6f-ad65-2ea34b140067",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--eae5f71d-eb57-5f1a-bbe0-e4d8aa050d25",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:01.844Z",
          "updated_at": "2026-09-26T20:33:02.397Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "713986b8-b6bc-45e7-b74b-4d0f30809c77",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "file--a33fbc4d-4a45-5f5b-9f58-2fce7c19bba9",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.214Z",
          "created_at": "2026-09-26T20:33:21.928Z",
          "modified": "2026-09-26T20:34:16.947Z",
          "updated_at": "2026-09-26T20:34:16.947Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--040a13fa-73ca-5b30-9564-33898020bf16",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:11.909Z",
          "updated_at": "2026-09-26T20:33:12.227Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "76018e03-902a-4ff4-af2b-df4ccb3c45b7",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--b55c3469-96a6-586c-8962-0de5faa47354",
        "type": "Url"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:11.238Z",
          "updated_at": "2026-09-26T20:33:11.806Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "78259501-030a-4da0-8bbe-6d1f9db2d324",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--599d3d43-fee3-5c60-8c3f-842985eda3f2",
        "type": "Url"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.231Z",
          "created_at": "2026-09-26T20:33:25.720Z",
          "modified": "2026-09-26T20:34:39.577Z",
          "updated_at": "2026-09-26T20:34:39.577Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "7b28427f-1b83-4229-b11d-7bc808c4253f",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--27132b5d-2aa2-58f4-b723-c0e93cf46fc9",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.196Z",
          "created_at": "2026-09-26T20:33:14.462Z",
          "modified": "2026-09-26T20:33:45.346Z",
          "updated_at": "2026-09-26T20:33:45.346Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "81d533ab-3152-43fa-bc94-eb59adbc1d0f",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--02821f76-54da-5a36-b096-d547a0264d36",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:32:58.316Z",
          "updated_at": "2026-09-26T20:32:58.904Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "89b07c43-4974-47f5-958a-e200a1cdd717",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--0abeb1f6-2979-543d-919d-99553824adea",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.203Z",
          "created_at": "2026-09-26T20:33:17.680Z",
          "modified": "2026-09-26T20:34:06.034Z",
          "updated_at": "2026-09-26T20:34:06.034Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "9d4a32dc-485b-4166-bca8-315876c3d089",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--4771b918-d98f-5ccc-8e40-ca2bffca492d",
        "type": "Indicator"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Entertainment"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.387Z",
          "created_at": "2026-01-18T14:35:01.844Z",
          "modified": "2026-01-22T04:46:03.897Z",
          "updated_at": "2026-01-22T04:46:03.897Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "a5d111b9-7252-4c03-adfa-2f0b9e818682",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Culture and entertainment",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "identity--945ef780-9be9-51e1-8157-dcc8f2d40216",
        "type": "Sector"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:00.332Z",
          "updated_at": "2026-09-26T20:33:00.722Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "ac1aad01-76bf-4a44-9aab-2b905e46824c",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--e997306b-73cf-5ac0-9d0e-648ede3a9f9f",
        "type": "Hostname"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Gaming",
          "Online Gaming Community"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.388Z",
          "created_at": "2026-01-18T14:35:02.871Z",
          "modified": "2026-01-22T03:05:05.400Z",
          "updated_at": "2026-01-22T03:05:05.400Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "acd8d77c-81e2-42a8-8abd-6c824b3b6dae",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Entertainment industry",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "identity--af35aaf9-fc34-5e65-9431-342ba739e7e6",
        "type": "Sector"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:00.064Z",
          "updated_at": "2026-09-26T20:33:00.720Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "b1e00ef7-78df-4436-aa19-af5d8f457855",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--860aeb08-5060-5f5b-b5b6-17a767a0634a",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.194Z",
          "created_at": "2026-09-26T20:33:13.170Z",
          "modified": "2026-09-26T20:33:45.127Z",
          "updated_at": "2026-09-26T20:33:45.127Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "bdf69473-097e-4a8d-bf8b-ff61e9768193",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--51710eef-d0d4-5dae-838c-71cc0f403560",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:32:59.248Z",
          "updated_at": "2026-09-26T20:32:59.642Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "c15c82bf-fd10-4642-8747-de28a4263678",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--b4b90374-96af-5d32-af38-e4c0860e812a",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.240Z",
          "created_at": "2026-09-26T20:33:28.359Z",
          "modified": "2026-09-26T20:35:31.692Z",
          "updated_at": "2026-09-26T20:35:31.692Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "c49fa4af-e345-49d8-871a-c71857cde10f",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--0cee6d97-6236-5f91-aeea-62035204a49d",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:32:59.821Z",
          "updated_at": "2026-09-26T20:33:00.058Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "c729999e-b4d0-4ded-8a83-5ecb20abee2b",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "hostname--d37e95b9-4e6c-53fa-84e4-cd4364cb91b5",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.233Z",
          "created_at": "2026-09-26T20:33:25.819Z",
          "modified": "2026-09-26T20:35:04.686Z",
          "updated_at": "2026-09-26T20:35:04.686Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "c7c920fb-f082-497d-af98-19e242a39788",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "indicator--7b885193-85d9-5b49-9c18-68f52a44f2ee",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:09.383Z",
          "updated_at": "2026-09-26T20:33:09.788Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "dd185a38-12df-484e-9410-9b2672e3d88f",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--2d20f4f0-b59c-5a95-bb59-63cdf0dac84d",
        "type": "Url"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:12.302Z",
          "updated_at": "2026-09-26T20:33:13.035Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "e15657ad-d265-4a2d-b360-f54282d0c733",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--1faa6956-60cf-507d-9083-00d56f2de9da",
        "type": "Url"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:10.835Z",
          "updated_at": "2026-09-26T20:33:11.244Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "f1858b22-f72f-4386-b1ec-1db066a3fb2c",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--a956005b-4622-5676-a219-f67c714b333a",
        "type": "Url"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:03.510Z",
          "updated_at": "2026-09-26T20:33:07.484Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "f2cf34a6-2e7c-41ba-a77b-4a74be4ebf95",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "file--94c9b4ba-0082-5350-88bf-fce6d21cf463",
        "type": "StixFile"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T20:33:11.906Z",
          "updated_at": "2026-09-26T20:33:12.225Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "faf02099-2b5b-4947-a9ec-87f6d6b3532f",
        "is_inferred": false,
        "labels": [
          "crypto",
          "embedding",
          "infostealer",
          "rat",
          "sectoprat"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "url--e80475ba-66cb-5a0d-b603-6e2d5ec7ba3d",
        "type": "Url"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.266Z",
          "created_at": "2026-09-26T20:35:54.696Z",
          "modified": "2026-09-26T20:35:57.946Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:35:57.946Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "5355250c-998a-41c9-a224-7662e0f5ecb4",
        "from_id": "5355250c-998a-41c9-a224-7662e0f5ecb4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "04a3a3ad-9476-4daf-9dcc-2cc80676f9b1",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--6fbe74f2-9664-5e41-8425-f71e62b65ef2",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.230Z",
          "created_at": "2026-09-26T20:33:51.321Z",
          "modified": "2026-09-26T20:33:51.728Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:51.728Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "53710c19-eb34-4051-85a4-3397cce04f5b",
        "from_id": "53710c19-eb34-4051-85a4-3397cce04f5b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "14655a67-6bea-4e15-94b4-f1fbc491af6b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--9652d5ab-7d13-59f4-b24a-fbf70ab8bf44",
        "toId": "4865ce19-0ef6-49a0-824e-0e1126e4f966",
        "to_id": "4865ce19-0ef6-49a0-824e-0e1126e4f966",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.389Z",
          "created_at": "2026-09-26T20:38:01.608Z",
          "modified": "2026-09-26T20:38:01.806Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:01.806Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "53710c19-eb34-4051-85a4-3397cce04f5b",
        "from_id": "53710c19-eb34-4051-85a4-3397cce04f5b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "148915c6-ee33-4447-9237-29f3d721a7b0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--f917b474-a233-5284-8bf8-7c40c37610a2",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.226Z",
          "created_at": "2026-09-26T20:33:49.515Z",
          "modified": "2026-09-28T20:29:54.403Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-28T20:29:54.403Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "1845229b-d72a-4cd3-82a7-51941fa308ef",
        "from_id": "1845229b-d72a-4cd3-82a7-51941fa308ef",
        "from_name": null,
        "from_type": "Indicator",
        "id": "16fa16d5-2f21-4af6-9957-239c957f4dad",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--a42e4587-5ce1-5371-8871-631f481153c6",
        "toId": "2cbaf03d-6389-4692-b7e5-c5bcea45e8b2",
        "to_id": "2cbaf03d-6389-4692-b7e5-c5bcea45e8b2",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.251Z",
          "created_at": "2026-09-26T20:35:10.384Z",
          "modified": "2026-09-26T20:35:14.522Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:35:14.522Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "bdf69473-097e-4a8d-bf8b-ff61e9768193",
        "from_id": "bdf69473-097e-4a8d-bf8b-ff61e9768193",
        "from_name": null,
        "from_type": "Indicator",
        "id": "1777bf55-e765-4d46-904e-d45b9f4c379a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--34486588-4c71-5f7a-951d-1f48f9c3cbdb",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.416Z",
          "created_at": "2026-09-26T20:38:18.142Z",
          "modified": "2026-09-26T20:38:18.435Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:18.435Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "c7c920fb-f082-497d-af98-19e242a39788",
        "from_id": "c7c920fb-f082-497d-af98-19e242a39788",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2330b63d-816c-4074-85f0-90eebd2d078f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--ec7bd178-eb9f-5e64-96b7-fad4d2be4e07",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.208Z",
          "created_at": "2026-09-26T20:33:45.112Z",
          "modified": "2026-09-26T20:33:45.668Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:45.668Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "6c0ba0e6-2a4f-4b76-9dd6-f87148d3eb4b",
        "from_id": "6c0ba0e6-2a4f-4b76-9dd6-f87148d3eb4b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2ba134fa-1b89-42dc-9535-b1bd70cad6c0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--ce72315d-23c7-583d-a7a6-e5e3c168bec3",
        "toId": "4bceb86b-61fd-4193-8670-648b37bf5b0e",
        "to_id": "4bceb86b-61fd-4193-8670-648b37bf5b0e",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.274Z",
          "created_at": "2026-09-26T20:36:06.584Z",
          "modified": "2026-09-26T20:36:06.967Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:36:06.967Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "7098b0da-a0a3-4e6f-ad65-2ea34b140067",
        "from_id": "7098b0da-a0a3-4e6f-ad65-2ea34b140067",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2c8fe517-252e-46bb-8d9c-40dfb4a42e1a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--db9ede71-02c4-584a-a717-94ee0f0a706e",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.232Z",
          "created_at": "2026-09-26T20:33:51.321Z",
          "modified": "2026-09-26T20:33:51.726Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:51.726Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "7b28427f-1b83-4229-b11d-7bc808c4253f",
        "from_id": "7b28427f-1b83-4229-b11d-7bc808c4253f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2dca2618-a3b7-41de-b577-f53321c039b8",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--e5048694-d01d-557a-8c5f-e921a11bf41c",
        "toId": "f1858b22-f72f-4386-b1ec-1db066a3fb2c",
        "to_id": "f1858b22-f72f-4386-b1ec-1db066a3fb2c",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.195Z",
          "created_at": "2026-09-26T20:33:41.648Z",
          "modified": "2026-09-26T20:33:42.279Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:42.279Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "bdf69473-097e-4a8d-bf8b-ff61e9768193",
        "from_id": "bdf69473-097e-4a8d-bf8b-ff61e9768193",
        "from_name": null,
        "from_type": "Indicator",
        "id": "30d6a5f0-62b1-4c26-8ebb-2a5536d9f567",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--640aeeb8-9856-5cae-be6e-ae20c5cd11c7",
        "toId": "89b07c43-4974-47f5-958a-e200a1cdd717",
        "to_id": "89b07c43-4974-47f5-958a-e200a1cdd717",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.206Z",
          "created_at": "2026-09-26T20:33:45.113Z",
          "modified": "2026-09-26T20:33:45.669Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:45.669Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "2211752f-91b9-42ef-ade7-600155196ac3",
        "from_id": "2211752f-91b9-42ef-ade7-600155196ac3",
        "from_name": null,
        "from_type": "Indicator",
        "id": "31d5ab47-ad9b-44ac-a4e6-412283a7a6cc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--a9d9edbb-2d42-5798-ab04-b950199df406",
        "toId": "6d0c5479-b088-4dc8-9b33-2735094a1b4a",
        "to_id": "6d0c5479-b088-4dc8-9b33-2735094a1b4a",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.347Z",
          "created_at": "2026-09-26T20:37:31.937Z",
          "modified": "2026-09-26T20:37:32.359Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:37:32.359Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "4c1469d2-62d9-451b-8616-68c4865aade9",
        "from_id": "4c1469d2-62d9-451b-8616-68c4865aade9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3892f874-751f-4e87-999d-1f5962abd2c8",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--2029ebbd-00fe-571b-8d86-b5bbbe5a9591",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.338Z",
          "created_at": "2026-09-26T20:37:24.579Z",
          "modified": "2026-09-26T20:37:25.217Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:37:25.217Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
        "from_id": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3a261f0d-27ce-4a5a-9912-fd1a9cb49956",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--7e096dec-beeb-507b-bc30-7bea7b1ad304",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.431Z",
          "created_at": "2026-09-26T20:38:36.093Z",
          "modified": "2026-09-26T20:38:36.525Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:36.525Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "212077e5-8ea5-42ec-8dc4-2e5434335640",
        "from_id": "212077e5-8ea5-42ec-8dc4-2e5434335640",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3af7aa31-cf74-492a-bc3d-46b9bf4b217f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--2d812165-ad02-5d8e-9a07-6123fb2166fc",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.315Z",
          "created_at": "2026-09-26T20:36:58.470Z",
          "modified": "2026-09-26T20:36:58.670Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:36:58.670Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
        "from_id": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3dfc873f-86a1-4b73-8491-5b6e560f4f08",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--941bb22b-2f0e-539f-82a9-217cc0d6b1ea",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.189Z",
          "created_at": "2026-09-26T20:33:34.640Z",
          "modified": "2026-09-26T20:33:35.228Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:35.228Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "from_name": "SectopRAT",
        "from_type": "Malware",
        "id": "3f270b6f-c246-41ab-92af-b9ad73f529af",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--e73e4691-cccc-5769-b5ca-cd36af499f79",
        "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404",
        "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404",
        "to_name": "Technologies",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.241Z",
          "created_at": "2026-09-26T20:33:53.538Z",
          "modified": "2026-09-26T20:33:54.636Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:54.636Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "c49fa4af-e345-49d8-871a-c71857cde10f",
        "from_id": "c49fa4af-e345-49d8-871a-c71857cde10f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "42ba6917-7f3d-47d2-9a87-ca2e1cb0e148",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--bb176679-7eb8-5e36-8105-1d47b1772a89",
        "toId": "76018e03-902a-4ff4-af2b-df4ccb3c45b7",
        "to_id": "76018e03-902a-4ff4-af2b-df4ccb3c45b7",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.282Z",
          "created_at": "2026-09-26T20:36:17.321Z",
          "modified": "2026-09-26T20:36:17.444Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:36:17.444Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "9d4a32dc-485b-4166-bca8-315876c3d089",
        "from_id": "9d4a32dc-485b-4166-bca8-315876c3d089",
        "from_name": null,
        "from_type": "Indicator",
        "id": "4600a0ee-9445-4792-bdea-9dce0ceca8ee",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--ad8a98a0-5431-5915-8e74-77754a8a056d",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.323Z",
          "created_at": "2026-09-26T20:37:05.702Z",
          "modified": "2026-09-26T20:37:06.134Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:37:06.134Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
        "from_id": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
        "from_name": null,
        "from_type": "Indicator",
        "id": "4caa2ef3-8336-4710-b4f5-518ccc329f4a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--7ca7cb0b-3364-5b27-b98a-c9ef1fafe0da",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.197Z",
          "created_at": "2026-09-26T20:33:42.104Z",
          "modified": "2026-09-26T20:33:43.024Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:43.024Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "81d533ab-3152-43fa-bc94-eb59adbc1d0f",
        "from_id": "81d533ab-3152-43fa-bc94-eb59adbc1d0f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "4cf9ca11-ade9-4c53-97cf-403baa884575",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--4c077fa9-fc21-5388-abdc-e6b2c5a36b9c",
        "toId": "c15c82bf-fd10-4642-8747-de28a4263678",
        "to_id": "c15c82bf-fd10-4642-8747-de28a4263678",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.357Z",
          "created_at": "2026-09-26T20:37:42.011Z",
          "modified": "2026-09-26T20:37:42.282Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:37:42.282Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "1845229b-d72a-4cd3-82a7-51941fa308ef",
        "from_id": "1845229b-d72a-4cd3-82a7-51941fa308ef",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5b6934c1-672f-4720-8cf2-796d00ef1823",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--4389b28c-bd3b-5190-808a-7bd2de2aa44d",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.234Z",
          "created_at": "2026-09-26T20:33:52.174Z",
          "modified": "2026-09-26T20:33:52.674Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:52.674Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "c7c920fb-f082-497d-af98-19e242a39788",
        "from_id": "c7c920fb-f082-497d-af98-19e242a39788",
        "from_name": null,
        "from_type": "Indicator",
        "id": "672d4035-b81a-4963-99fb-035dc74ae47a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--25606ce4-64c2-581a-a4ef-0e907c120ebe",
        "toId": "18ecacfd-e2e7-4040-b64b-6d7361a96b25",
        "to_id": "18ecacfd-e2e7-4040-b64b-6d7361a96b25",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.200Z",
          "created_at": "2026-09-26T20:33:43.587Z",
          "modified": "2026-09-26T20:33:44.375Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:44.375Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "5355250c-998a-41c9-a224-7662e0f5ecb4",
        "from_id": "5355250c-998a-41c9-a224-7662e0f5ecb4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7495955c-389b-4558-ad97-fe269c131688",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--5ba43094-6433-5e7a-95a8-a4f4b2fee2ac",
        "toId": "c729999e-b4d0-4ded-8a83-5ecb20abee2b",
        "to_id": "c729999e-b4d0-4ded-8a83-5ecb20abee2b",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.216Z",
          "created_at": "2026-09-26T20:33:46.555Z",
          "modified": "2026-09-26T20:33:48.681Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:48.681Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
        "from_id": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
        "from_name": null,
        "from_type": "Indicator",
        "id": "78f3fca4-886e-4e43-b18c-c16950fd6fce",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--6f573794-16e3-5c29-9178-82711f62da1e",
        "toId": "3bf6cd1e-a991-42e3-a00f-66173694950d",
        "to_id": "3bf6cd1e-a991-42e3-a00f-66173694950d",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.388Z",
          "created_at": "2026-01-18T14:35:19.401Z",
          "modified": "2026-01-18T14:35:19.646Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-01-18T14:35:19.646Z"
        },
        "description_available": true,
        "entity_type": "part-of",
        "fromId": "acd8d77c-81e2-42a8-8abd-6c824b3b6dae",
        "from_id": "acd8d77c-81e2-42a8-8abd-6c824b3b6dae",
        "from_name": "Entertainment industry",
        "from_type": "Sector",
        "id": "7937501a-b8f6-44dc-b0c1-909cf61b037b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "part-of",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--026dd5d3-c4f8-5a25-af89-6e4678b17de8",
        "toId": "a5d111b9-7252-4c03-adfa-2f0b9e818682",
        "to_id": "a5d111b9-7252-4c03-adfa-2f0b9e818682",
        "to_name": "Culture and entertainment",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.259Z",
          "created_at": "2026-09-26T20:35:42.438Z",
          "modified": "2026-09-26T20:35:42.965Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:35:42.965Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "81d533ab-3152-43fa-bc94-eb59adbc1d0f",
        "from_id": "81d533ab-3152-43fa-bc94-eb59adbc1d0f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7d22897e-9af7-4a81-a6a1-9b56bb02ac11",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--afeedd39-fcec-5f46-93a3-f44252f6ddee",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.307Z",
          "created_at": "2026-09-26T20:36:48.548Z",
          "modified": "2026-09-26T20:36:51.094Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:36:51.094Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
        "from_id": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
        "from_name": null,
        "from_type": "Indicator",
        "id": "8417dff6-c7b2-4ea4-8369-b74b26a9c59c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--cd2af4b2-8685-50b2-9b27-e3b794975a89",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.374Z",
          "created_at": "2026-09-26T20:37:48.548Z",
          "modified": "2026-09-26T20:37:48.686Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:37:48.686Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
        "from_id": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
        "from_name": null,
        "from_type": "Indicator",
        "id": "894cd2d7-7c5a-4877-9b13-a75ab2866697",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--41d8dc4c-8714-59b2-a317-1ea4345693c8",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.221Z",
          "created_at": "2026-09-26T20:33:49.499Z",
          "modified": "2026-09-26T20:33:50.277Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:50.277Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
        "from_id": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
        "from_name": null,
        "from_type": "Indicator",
        "id": "906b1747-b94e-416e-a6ac-3b9c552fb657",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--1c7a5cce-204a-55b8-a8a1-81238fd21814",
        "toId": "68f78078-e0e9-4336-b288-d743ae45315a",
        "to_id": "68f78078-e0e9-4336-b288-d743ae45315a",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.223Z",
          "created_at": "2026-09-26T20:33:49.500Z",
          "modified": "2026-09-26T20:33:50.619Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:50.619Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "4c1469d2-62d9-451b-8616-68c4865aade9",
        "from_id": "4c1469d2-62d9-451b-8616-68c4865aade9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "95d8b114-480f-4eee-b753-7dc4ab48209a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--00182bcf-fb39-5c06-aa8f-2c0a1df0967e",
        "toId": "dd185a38-12df-484e-9410-9b2672e3d88f",
        "to_id": "dd185a38-12df-484e-9410-9b2672e3d88f",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.189Z",
          "created_at": "2026-09-26T20:33:30.388Z",
          "modified": "2026-09-26T20:33:31.549Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:31.549Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "from_name": "SectopRAT",
        "from_type": "Malware",
        "id": "978d8ab5-33f5-427b-9cd3-90de63045769",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--27a2a186-d4b6-5b48-8add-4cbef038b159",
        "toId": "acd8d77c-81e2-42a8-8abd-6c824b3b6dae",
        "to_id": "acd8d77c-81e2-42a8-8abd-6c824b3b6dae",
        "to_name": "Entertainment industry",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.244Z",
          "created_at": "2026-09-26T20:33:53.531Z",
          "modified": "2026-09-26T20:33:54.634Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:54.634Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "5681fd55-0ee6-4d34-b32b-ec3fa559a8da",
        "from_id": "5681fd55-0ee6-4d34-b32b-ec3fa559a8da",
        "from_name": null,
        "from_type": "Indicator",
        "id": "99331763-38f3-4fc9-9739-470d3dd03105",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--8b247eb8-7270-5644-9ce3-beb2c055549e",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.236Z",
          "created_at": "2026-09-26T20:33:52.280Z",
          "modified": "2026-09-26T20:33:52.673Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:52.673Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
        "from_id": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9a36a11a-db5c-440a-9e1e-7952aa2cc880",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--72526dec-afad-5bfd-af21-5b8f43fc3b2a",
        "toId": "78259501-030a-4da0-8bbe-6d1f9db2d324",
        "to_id": "78259501-030a-4da0-8bbe-6d1f9db2d324",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.202Z",
          "created_at": "2026-09-26T20:33:43.578Z",
          "modified": "2026-09-26T20:33:44.376Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:44.376Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "7098b0da-a0a3-4e6f-ad65-2ea34b140067",
        "from_id": "7098b0da-a0a3-4e6f-ad65-2ea34b140067",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a0040fb1-755d-4409-9399-2b9c94b7f54c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--3c4db892-a0d1-542d-9132-c4d26efa10b0",
        "toId": "b1e00ef7-78df-4436-aa19-af5d8f457855",
        "to_id": "b1e00ef7-78df-4436-aa19-af5d8f457855",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.218Z",
          "created_at": "2026-09-26T20:33:46.562Z",
          "modified": "2026-09-26T20:33:48.683Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:48.683Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
        "from_id": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a7aaa1ee-bc88-485a-ae7a-aa683cb9822e",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--d7593791-cd1b-50b9-848b-ce5d34c254c9",
        "toId": "f2cf34a6-2e7c-41ba-a77b-4a74be4ebf95",
        "to_id": "f2cf34a6-2e7c-41ba-a77b-4a74be4ebf95",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.204Z",
          "created_at": "2026-09-26T20:33:43.716Z",
          "modified": "2026-09-26T20:33:44.377Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:44.377Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "9d4a32dc-485b-4166-bca8-315876c3d089",
        "from_id": "9d4a32dc-485b-4166-bca8-315876c3d089",
        "from_name": null,
        "from_type": "Indicator",
        "id": "aeedbbbd-0657-4d21-abaf-187e0a82fdb6",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--9a4c2bcc-14f6-5e7b-be9f-1592c909aa6b",
        "toId": "ac1aad01-76bf-4a44-9aab-2b905e46824c",
        "to_id": "ac1aad01-76bf-4a44-9aab-2b905e46824c",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.213Z",
          "created_at": "2026-09-26T20:33:46.451Z",
          "modified": "2026-09-26T20:33:48.682Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:48.682Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
        "from_id": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b03b6cdc-673b-4f79-a809-e19e4ef63eaf",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--2c81fb15-9eb3-5c01-90e8-f59322680485",
        "toId": "4da84bf2-4e47-4ed2-8187-1e97193b2962",
        "to_id": "4da84bf2-4e47-4ed2-8187-1e97193b2962",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.441Z",
          "created_at": "2026-09-26T20:38:47.406Z",
          "modified": "2026-09-26T20:38:47.615Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:47.615Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "c49fa4af-e345-49d8-871a-c71857cde10f",
        "from_id": "c49fa4af-e345-49d8-871a-c71857cde10f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b2f4d5ec-6349-4932-8c84-c32e58b8f95d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--e2dcdf94-529e-5a92-adb4-52bcba37ca91",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.405Z",
          "created_at": "2026-09-26T20:38:08.686Z",
          "modified": "2026-09-26T20:38:09.398Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:09.398Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "7b28427f-1b83-4229-b11d-7bc808c4253f",
        "from_id": "7b28427f-1b83-4229-b11d-7bc808c4253f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "bd50cde8-3a90-4332-b106-a928b6e570f7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--d440a744-074f-51a1-b6c9-68faeb8ce17a",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.243Z",
          "created_at": "2026-09-26T20:33:53.525Z",
          "modified": "2026-09-26T20:33:54.497Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:54.497Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
        "from_id": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "bdcd27fc-4b21-4f34-8804-353ff6f99413",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--aa330fd1-df2f-5b94-8479-1feff5779c0e",
        "toId": "e15657ad-d265-4a2d-b360-f54282d0c733",
        "to_id": "e15657ad-d265-4a2d-b360-f54282d0c733",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.193Z",
          "created_at": "2026-09-26T20:33:41.521Z",
          "modified": "2026-09-26T20:33:41.943Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:41.943Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "5681fd55-0ee6-4d34-b32b-ec3fa559a8da",
        "from_id": "5681fd55-0ee6-4d34-b32b-ec3fa559a8da",
        "from_name": null,
        "from_type": "Indicator",
        "id": "bf819114-5052-497e-a632-bc1f3355e5c7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--d3d4129e-9ce6-5ec4-bd8f-d66b2e10a196",
        "toId": "0bc4a8ba-df16-4130-b37f-1aa7bdd387c7",
        "to_id": "0bc4a8ba-df16-4130-b37f-1aa7bdd387c7",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.298Z",
          "created_at": "2026-09-26T20:36:41.187Z",
          "modified": "2026-09-26T20:36:41.867Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:36:41.867Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "6c0ba0e6-2a4f-4b76-9dd6-f87148d3eb4b",
        "from_id": "6c0ba0e6-2a4f-4b76-9dd6-f87148d3eb4b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c26e9204-2339-4ce3-9ebb-cd5768a00547",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--2db9dc3c-52ae-54a2-9c93-a817de412d11",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.423Z",
          "created_at": "2026-09-26T20:38:25.049Z",
          "modified": "2026-09-26T20:38:25.276Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:25.276Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
        "from_id": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "cfc5c3c2-a268-4155-b338-7b64822372b9",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--8f3e46ca-0494-5c3a-8536-dd25857d847e",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.239Z",
          "created_at": "2026-09-26T20:33:52.281Z",
          "modified": "2026-09-26T20:33:52.677Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:52.677Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "212077e5-8ea5-42ec-8dc4-2e5434335640",
        "from_id": "212077e5-8ea5-42ec-8dc4-2e5434335640",
        "from_name": null,
        "from_type": "Indicator",
        "id": "cffb4529-7a91-41ac-8f21-7c5da3151fbc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--c7b299b6-f757-5017-b08c-91fb71f066c1",
        "toId": "faf02099-2b5b-4947-a9ec-87f6d6b3532f",
        "to_id": "faf02099-2b5b-4947-a9ec-87f6d6b3532f",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.448Z",
          "created_at": "2026-09-26T20:38:57.168Z",
          "modified": "2026-09-26T20:38:57.629Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:38:57.629Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
        "from_id": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "dd1033e6-689e-4712-86e1-873ecd60e13d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--b67962e8-ca7e-577a-bef9-3fec380789fd",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.211Z",
          "created_at": "2026-09-26T20:33:45.113Z",
          "modified": "2026-09-26T20:33:45.667Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:45.667Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
        "from_id": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
        "from_name": null,
        "from_type": "Indicator",
        "id": "eb0e8e52-7564-40cd-b0c2-c34652976b71",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--bf176f04-985e-5be9-9952-b4e285b2a80d",
        "toId": "713986b8-b6bc-45e7-b74b-4d0f30809c77",
        "to_id": "713986b8-b6bc-45e7-b74b-4d0f30809c77",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.290Z",
          "created_at": "2026-09-26T20:36:29.449Z",
          "modified": "2026-09-26T20:36:29.757Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:36:29.757Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "2211752f-91b9-42ef-ade7-600155196ac3",
        "from_id": "2211752f-91b9-42ef-ade7-600155196ac3",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ebfb8fc6-34bf-4649-b0e8-2512da1d551c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--8285836e-7f53-59bb-a194-93bbbf85ca4b",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.228Z",
          "created_at": "2026-09-26T20:33:50.910Z",
          "modified": "2026-09-26T20:33:51.487Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:33:51.487Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
        "from_id": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ed3b93b0-0219-4651-a0aa-60afa8546e71",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--473c0c13-3706-5993-a4fc-0f89dec05e27",
        "toId": "43bd74e7-6b62-4ceb-b175-b4a5567a7d8c",
        "to_id": "43bd74e7-6b62-4ceb-b175-b4a5567a7d8c",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-25T15:03:46.331Z",
          "created_at": "2026-09-26T20:37:15.743Z",
          "modified": "2026-09-26T20:37:15.989Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T20:37:15.989Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
        "from_id": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "fd002d60-3c00-4beb-93d9-63e9301ce4cd",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "standard_id": "relationship--0d6d46c4-4f07-5345-88f1-ecb239d9ebce",
        "toId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "to_name": "SectopRAT",
        "to_type": "Malware"
      }
    ],
    "iocs": [
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "a12ba3a3dcd70e02f89253c9ec78b11f",
        "description_available": false,
        "object_id": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
        "object_ids": [
          "245e1d09-9f8c-438e-bca0-b6bad8cac794",
          "713986b8-b6bc-45e7-b74b-4d0f30809c77"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "245e1d09-9f8c-438e-bca0-b6bad8cac794",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2027-07-13T01:51:59.557Z",
            "validity_status": "active",
            "value": "a12ba3a3dcd70e02f89253c9ec78b11f"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "713986b8-b6bc-45e7-b74b-4d0f30809c77",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "a12ba3a3dcd70e02f89253c9ec78b11f"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "md5",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2027-07-13T01:51:59.557Z",
        "validity_status": "active",
        "value": "a12ba3a3dcd70e02f89253c9ec78b11f"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "37fcbcb21d16866784050682c58424c91d3a736f6fd599271fa6e53cf5ca8a92",
        "description_available": false,
        "object_id": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
        "object_ids": [
          "08648a91-08a3-480e-9d5d-1bef9cb1555a",
          "4da84bf2-4e47-4ed2-8187-1e97193b2962"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "08648a91-08a3-480e-9d5d-1bef9cb1555a",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2027-07-13T01:51:59.557Z",
            "validity_status": "active",
            "value": "37fcbcb21d16866784050682c58424c91d3a736f6fd599271fa6e53cf5ca8a92"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "4da84bf2-4e47-4ed2-8187-1e97193b2962",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "37fcbcb21d16866784050682c58424c91d3a736f6fd599271fa6e53cf5ca8a92"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "sha256",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2027-07-13T01:51:59.557Z",
        "validity_status": "active",
        "value": "37fcbcb21d16866784050682c58424c91d3a736f6fd599271fa6e53cf5ca8a92"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "48d3ecbb9e0b6babe6e53e2082a076bad07ef61ccd98dcc8b9e4f390b937788b",
        "description_available": false,
        "object_id": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
        "object_ids": [
          "3bf6cd1e-a991-42e3-a00f-66173694950d",
          "7487f2af-51d0-47ac-b3e0-6eb13d24fc86"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "7487f2af-51d0-47ac-b3e0-6eb13d24fc86",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2027-07-13T01:51:59.557Z",
            "validity_status": "active",
            "value": "48d3ecbb9e0b6babe6e53e2082a076bad07ef61ccd98dcc8b9e4f390b937788b"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "3bf6cd1e-a991-42e3-a00f-66173694950d",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "48d3ecbb9e0b6babe6e53e2082a076bad07ef61ccd98dcc8b9e4f390b937788b"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "sha256",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2027-07-13T01:51:59.557Z",
        "validity_status": "active",
        "value": "48d3ecbb9e0b6babe6e53e2082a076bad07ef61ccd98dcc8b9e4f390b937788b"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "95f6abd3c43ef4b33cd61d054527233dd2ce705804d44a04be96cfb73bb52e3a",
        "description_available": false,
        "object_id": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
        "object_ids": [
          "1ea1e163-de4b-4b78-8144-2aa918e350a9",
          "f2cf34a6-2e7c-41ba-a77b-4a74be4ebf95"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "1ea1e163-de4b-4b78-8144-2aa918e350a9",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2027-07-13T01:51:59.557Z",
            "validity_status": "active",
            "value": "95f6abd3c43ef4b33cd61d054527233dd2ce705804d44a04be96cfb73bb52e3a"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "f2cf34a6-2e7c-41ba-a77b-4a74be4ebf95",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "95f6abd3c43ef4b33cd61d054527233dd2ce705804d44a04be96cfb73bb52e3a"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "sha256",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2027-07-13T01:51:59.557Z",
        "validity_status": "active",
        "value": "95f6abd3c43ef4b33cd61d054527233dd2ce705804d44a04be96cfb73bb52e3a"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "efa07701570983909ef923ea79bb032f19fd9dac0b819fa0e4f6b1161a4cc221",
        "description_available": false,
        "object_id": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
        "object_ids": [
          "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
          "68f78078-e0e9-4336-b288-d743ae45315a"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "6353ac45-2c70-4094-9816-5f6f8ddabfd8",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2027-07-13T01:51:59.557Z",
            "validity_status": "active",
            "value": "efa07701570983909ef923ea79bb032f19fd9dac0b819fa0e4f6b1161a4cc221"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "68f78078-e0e9-4336-b288-d743ae45315a",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "efa07701570983909ef923ea79bb032f19fd9dac0b819fa0e4f6b1161a4cc221"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "sha256",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2027-07-13T01:51:59.557Z",
        "validity_status": "active",
        "value": "efa07701570983909ef923ea79bb032f19fd9dac0b819fa0e4f6b1161a4cc221"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxp[:]//98[.]142[.]252[.]140[:]15847",
        "description_available": false,
        "object_id": "4c1469d2-62d9-451b-8616-68c4865aade9",
        "object_ids": [
          "4c1469d2-62d9-451b-8616-68c4865aade9",
          "dd185a38-12df-484e-9410-9b2672e3d88f"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "4c1469d2-62d9-451b-8616-68c4865aade9",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "http://98.142.252.140:15847"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "dd185a38-12df-484e-9410-9b2672e3d88f",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "http://98.142.252.140:15847"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "http://98.142.252.140:15847"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxp[:]//98[.]142[.]252[.]140[:]9000/wmglb",
        "description_available": false,
        "object_id": "1845229b-d72a-4cd3-82a7-51941fa308ef",
        "object_ids": [
          "1845229b-d72a-4cd3-82a7-51941fa308ef",
          "2cbaf03d-6389-4692-b7e5-c5bcea45e8b2"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "1845229b-d72a-4cd3-82a7-51941fa308ef",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "http://98.142.252.140:9000/wmglb"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "2cbaf03d-6389-4692-b7e5-c5bcea45e8b2",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "http://98.142.252.140:9000/wmglb"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "http://98.142.252.140:9000/wmglb"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed1[.]defibit[.]io/",
        "description_available": false,
        "object_id": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
        "object_ids": [
          "43bd74e7-6b62-4ceb-b175-b4a5567a7d8c",
          "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "62ccc22d-d7cd-4e5b-a16c-561b953a0fa6",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed1.defibit.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "43bd74e7-6b62-4ceb-b175-b4a5567a7d8c",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed1.defibit.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed1.defibit.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed1[.]ninicoin[.]io/",
        "description_available": false,
        "object_id": "53710c19-eb34-4051-85a4-3397cce04f5b",
        "object_ids": [
          "4865ce19-0ef6-49a0-824e-0e1126e4f966",
          "53710c19-eb34-4051-85a4-3397cce04f5b"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "53710c19-eb34-4051-85a4-3397cce04f5b",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed1.ninicoin.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "4865ce19-0ef6-49a0-824e-0e1126e4f966",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed1.ninicoin.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed1.ninicoin.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed2[.]defibit[.]io/",
        "description_available": false,
        "object_id": "7b28427f-1b83-4229-b11d-7bc808c4253f",
        "object_ids": [
          "7b28427f-1b83-4229-b11d-7bc808c4253f",
          "f1858b22-f72f-4386-b1ec-1db066a3fb2c"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "7b28427f-1b83-4229-b11d-7bc808c4253f",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed2.defibit.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "f1858b22-f72f-4386-b1ec-1db066a3fb2c",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed2.defibit.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed2.defibit.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed2[.]ninicoin[.]io/",
        "description_available": false,
        "object_id": "c7c920fb-f082-497d-af98-19e242a39788",
        "object_ids": [
          "18ecacfd-e2e7-4040-b64b-6d7361a96b25",
          "c7c920fb-f082-497d-af98-19e242a39788"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "c7c920fb-f082-497d-af98-19e242a39788",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed2.ninicoin.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "18ecacfd-e2e7-4040-b64b-6d7361a96b25",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed2.ninicoin.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed2.ninicoin.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed3[.]defibit[.]io/",
        "description_available": false,
        "object_id": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
        "object_ids": [
          "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
          "78259501-030a-4da0-8bbe-6d1f9db2d324"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "4e375917-e9cf-4928-8ec0-f023dd55d1b9",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed3.defibit.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "78259501-030a-4da0-8bbe-6d1f9db2d324",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed3.defibit.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed3.defibit.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed3[.]ninicoin[.]io/",
        "description_available": false,
        "object_id": "212077e5-8ea5-42ec-8dc4-2e5434335640",
        "object_ids": [
          "212077e5-8ea5-42ec-8dc4-2e5434335640",
          "faf02099-2b5b-4947-a9ec-87f6d6b3532f"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "212077e5-8ea5-42ec-8dc4-2e5434335640",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed3.ninicoin.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "faf02099-2b5b-4947-a9ec-87f6d6b3532f",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed3.ninicoin.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed3.ninicoin.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed4[.]defibit[.]io/",
        "description_available": false,
        "object_id": "c49fa4af-e345-49d8-871a-c71857cde10f",
        "object_ids": [
          "76018e03-902a-4ff4-af2b-df4ccb3c45b7",
          "c49fa4af-e345-49d8-871a-c71857cde10f"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "c49fa4af-e345-49d8-871a-c71857cde10f",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed4.defibit.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "76018e03-902a-4ff4-af2b-df4ccb3c45b7",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed4.defibit.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed4.defibit.io/"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//bsc-dataseed4[.]ninicoin[.]io/",
        "description_available": false,
        "object_id": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
        "object_ids": [
          "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
          "e15657ad-d265-4a2d-b360-f54282d0c733"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "62ed6f09-8f92-4915-8b24-c6b90e0bc94b",
            "valid_from": "2026-09-25T14:42:15.000Z",
            "valid_until": "2026-10-15T20:16:54.434Z",
            "validity_status": "active",
            "value": "https://bsc-dataseed4.ninicoin.io/"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "e15657ad-d265-4a2d-b360-f54282d0c733",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://bsc-dataseed4.ninicoin.io/"
          }
        ],
        "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
        "type": "url",
        "valid_from": "2026-09-25T14:42:15.000Z",
        "valid_until": "2026-10-15T20:16:54.434Z",
        "validity_status": "active",
        "value": "https://bsc-dataseed4.ninicoin.io/"
      }
    ],
    "mentioned": [
      {
        "confidence": 50,
        "evidence_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
        "name": "SectopRAT",
        "role": "mentionné",
        "type": "Malware"
      },
      {
        "confidence": 100,
        "evidence_id": "a5d111b9-7252-4c03-adfa-2f0b9e818682",
        "name": "Culture and entertainment",
        "role": "mentionné",
        "type": "Sector"
      }
    ],
    "mitre": {
      "associated_repertoire": [
        {
          "complete": true,
          "relationships": [
            {
              "__typename": "StixCoreRelationship",
              "authorized_members": [],
              "confidence": 50,
              "created_by": null,
              "dates": {
                "created": "2026-01-19T19:48:01.509Z",
                "created_at": "2026-03-14T10:19:57.852Z",
                "modified": "2026-03-14T10:19:59.637Z",
                "start_time": "1970-01-01T00:00:00.000Z",
                "stop_time": "5138-11-16T09:46:40.000Z",
                "updated_at": "2026-03-14T10:19:59.637Z"
              },
              "description_available": false,
              "entity_type": "uses",
              "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
              "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
              "from_name": "SectopRAT",
              "from_type": "Malware",
              "id": "73d62ff6-1791-46ae-b8a5-1d33140607e8",
              "is_inferred": false,
              "objectMarking": [
                {
                  "definition": "TLP:CLEAR",
                  "definition_type": "TLP"
                }
              ],
              "objectOrganization": [],
              "references": [],
              "relationship_type": "uses",
              "restrict_access": false,
              "revoked": false,
              "scope": "entity-context",
              "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
              "standard_id": "relationship--5a02ab15-90ae-51c3-8232-7f950aff74b6",
              "toId": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0",
              "to_id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0",
              "to_name": "T1085",
              "to_type": "AttackPattern"
            },
            {
              "__typename": "StixCoreRelationship",
              "authorized_members": [],
              "confidence": 50,
              "created_by": null,
              "dates": {
                "created": "2026-01-19T19:48:01.518Z",
                "created_at": "2026-03-14T10:20:02.385Z",
                "modified": "2026-03-14T10:20:03.764Z",
                "start_time": "1970-01-01T00:00:00.000Z",
                "stop_time": "5138-11-16T09:46:40.000Z",
                "updated_at": "2026-03-14T10:20:03.764Z"
              },
              "description_available": false,
              "entity_type": "uses",
              "fromId": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
              "from_id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
              "from_name": "SectopRAT",
              "from_type": "Malware",
              "id": "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d",
              "is_inferred": false,
              "objectMarking": [
                {
                  "definition": "TLP:CLEAR",
                  "definition_type": "TLP"
                }
              ],
              "objectOrganization": [],
              "references": [],
              "relationship_type": "uses",
              "restrict_access": false,
              "revoked": false,
              "scope": "entity-context",
              "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
              "standard_id": "relationship--15da5603-8d08-5327-9d1f-51f76b77813f",
              "toId": "ea4de683-0cad-4497-a044-65b61045d534",
              "to_id": "ea4de683-0cad-4497-a044-65b61045d534",
              "to_name": "T1574.002",
              "to_type": "AttackPattern"
            }
          ],
          "scope": "entity-context",
          "techniques": [
            {
              "aliases": [],
              "attributes": {
                "x_mitre_id": "T1085"
              },
              "authorized_members": [],
              "confidence": 50,
              "created": "2026-01-18T18:02:56.967Z",
              "created_by": null,
              "dates": {
                "created": "2026-01-18T18:02:56.967Z",
                "created_at": "2026-01-18T18:20:24.501Z",
                "modified": "2026-01-18T18:20:26.536Z",
                "updated_at": "2026-01-18T18:20:26.536Z"
              },
              "description_available": false,
              "evidence_ids": [
                "73d62ff6-1791-46ae-b8a5-1d33140607e8",
                "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0"
              ],
              "external_id": "T1085",
              "id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0",
              "is_inferred": false,
              "kill_chain_phases": [],
              "labels": [],
              "lang": "en",
              "mitre_id": "T1085",
              "modified": "2026-01-18T18:20:26.536Z",
              "name": "T1085",
              "objectMarking": [
                {
                  "definition": "TLP:CLEAR",
                  "definition_type": "TLP"
                }
              ],
              "objectOrganization": [],
              "references": [
                {
                  "external_id": "T1085",
                  "id": "584a166f-e9d7-4867-b842-dcf1ba7a5aaf",
                  "source_name": "mitre-attack",
                  "url": "https://attack.mitre.org/techniques/T1085"
                }
              ],
              "relationship_ids": [
                "73d62ff6-1791-46ae-b8a5-1d33140607e8"
              ],
              "restrict_access": false,
              "revoked": false,
              "scope": "entity-context",
              "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
              "tactics": [],
              "url": "https://attack.mitre.org/techniques/T1085/",
              "via_entities": [
                {
                  "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
                  "name": "SectopRAT",
                  "type": "Malware"
                }
              ]
            },
            {
              "aliases": [],
              "attributes": {
                "x_mitre_id": "T1574.002"
              },
              "authorized_members": [],
              "confidence": 50,
              "created": "2026-01-18T18:28:11.149Z",
              "created_by": null,
              "dates": {
                "created": "2026-01-18T18:28:11.149Z",
                "created_at": "2026-01-21T11:31:18.951Z",
                "modified": "2026-01-21T11:31:19.843Z",
                "updated_at": "2026-01-21T11:31:19.843Z"
              },
              "description_available": false,
              "evidence_ids": [
                "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d",
                "ea4de683-0cad-4497-a044-65b61045d534"
              ],
              "external_id": "T1574.002",
              "id": "ea4de683-0cad-4497-a044-65b61045d534",
              "is_inferred": false,
              "kill_chain_phases": [],
              "labels": [],
              "lang": "en",
              "mitre_id": "T1574.002",
              "modified": "2026-01-21T11:31:19.843Z",
              "name": "T1574.002",
              "objectMarking": [
                {
                  "definition": "TLP:CLEAR",
                  "definition_type": "TLP"
                }
              ],
              "objectOrganization": [],
              "references": [
                {
                  "external_id": "T1574.002",
                  "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955",
                  "source_name": "mitre-attack",
                  "url": "https://attack.mitre.org/techniques/T1574/002"
                }
              ],
              "relationship_ids": [
                "e9ffb1e2-1e48-47b2-9597-3ee73cb09e5d"
              ],
              "restrict_access": false,
              "revoked": false,
              "scope": "entity-context",
              "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software",
              "tactics": [],
              "url": "https://attack.mitre.org/techniques/T1574/002/",
              "via_entities": [
                {
                  "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
                  "name": "SectopRAT",
                  "type": "Malware"
                }
              ]
            }
          ],
          "via_entity": {
            "id": "1bb20a9b-eb68-4e07-b579-35a1743fa3c0",
            "name": "SectopRAT",
            "type": "Malware"
          }
        }
      ],
      "direct_techniques": [],
      "official_catalog": {
        "complete": true,
        "fetched_at": "2026-10-10T20:26:09Z",
        "schema_version": 1,
        "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730",
        "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json",
        "techniques": [
          {
            "attack_version": "1.2",
            "canonical_url": "https://attack.mitre.org/techniques/T1085/",
            "created": "2017-05-31T21:31:06.045Z",
            "deprecated": false,
            "matched": true,
            "mitre_id": "T1085",
            "modified": "2026-04-14T22:53:14.952Z",
            "official_name": "Rundll32",
            "official_status": "revoked",
            "official_tactics": [
              {
                "mitre_id": "TA0002",
                "name": "Execution",
                "shortname": "execution"
              },
              {
                "mitre_id": "TA0005",
                "name": "Stealth",
                "shortname": "stealth"
              }
            ],
            "replacements": [
              {
                "canonical_url": "https://attack.mitre.org/techniques/T1218/011/",
                "mitre_id": "T1218.011",
                "official_name": "Rundll32",
                "official_status": "active",
                "relationship_id": "relationship--4d7a9d82-1400-42bd-982a-3e0e4d9396fa",
                "stix_id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5"
              }
            ],
            "revoked": true,
            "stix_id": "attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5"
          },
          {
            "attack_version": "2.1",
            "canonical_url": "https://attack.mitre.org/techniques/T1574/002/",
            "created": "2020-03-13T19:41:37.908Z",
            "deprecated": false,
            "matched": true,
            "mitre_id": "T1574.002",
            "modified": "2026-04-15T22:56:43.434Z",
            "official_name": "DLL Side-Loading",
            "official_status": "revoked",
            "official_tactics": [
              {
                "mitre_id": "TA0002",
                "name": "Execution",
                "shortname": "execution"
              },
              {
                "mitre_id": "TA0005",
                "name": "Stealth",
                "shortname": "stealth"
              }
            ],
            "replacements": [
              {
                "canonical_url": "https://attack.mitre.org/techniques/T1574/001/",
                "mitre_id": "T1574.001",
                "official_name": "DLL",
                "official_status": "active",
                "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2",
                "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34"
              }
            ],
            "revoked": true,
            "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b"
          }
        ]
      }
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-25T14:42:13.856Z",
        "created_at": "2026-09-26T20:39:07.677Z",
        "modified": "2026-09-26T20:39:12.439Z",
        "published": "2026-09-25T14:42:13.856Z",
        "updated_at": "2026-09-26T20:39:12.439Z"
      },
      "description_available": true,
      "id": "dcce3e61-549e-4762-90b1-20f20f2f1865",
      "is_inferred": false,
      "labels": [
        "crypto",
        "embedding",
        "infostealer",
        "rat",
        "sectoprat"
      ],
      "lang": "en",
      "name": "Uncovering a SectopRAT Variant Embedded in Legitimate Software",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-25T14:42:13.856Z",
      "references": [
        {
          "external_id": null,
          "id": "a63b1886-e13e-4480-8809-ad0c5e726dd1",
          "source_name": "alien-vault",
          "url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software"
        },
        {
          "external_id": "6ab688467ce23517fb31e378",
          "id": "fa0d99b7-165a-480c-b91b-2deffebc7638",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6ab688467ce23517fb31e378"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software"
    },
    "targets": [
      {
        "confidence": 50,
        "evidence_id": "978d8ab5-33f5-427b-9cd3-90de63045769",
        "name": "Entertainment industry",
        "role": "cible déclarée (relation targets)",
        "type": "Sector"
      },
      {
        "confidence": 50,
        "evidence_id": "3f270b6f-c246-41ab-92af-b9ad73f529af",
        "name": "Technologies",
        "role": "cible déclarée (relation targets)",
        "type": "Sector"
      }
    ],
    "techniques": [],
    "vulnerabilities": []
  },
  "report_id": "dcce3e61-549e-4762-90b1-20f20f2f1865",
  "schema_version": 1,
  "selected_date": "2026-09-25",
  "source_url": "https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software"
}