misp-galaxy:tool="KHRAT",misp-galaxy:rat="KhRAT",tlp:white,circl:incident-classification="malware",osint:source-type="blog-post",misp-galaxy:threat-actor="RANCOR",misp-galaxy:mitre-enterprise-attack-attack-pattern="Spearphishing Attachment - T1193"