{ "Event": { "uuid": "046c9c12-5c3e-4ec8-ac8f-078cc0607e64", "Attribute": [ { "uuid": "e982b5ab-fd2b-5d7b-858b-f65ba6766c5b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "sha256", "value": "9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gorbag\", \"specimen_sha256\": \"9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Workbook delivery and recovered-PE behavior refer to distinct linked specimens.\", \"The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL.\", \"The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "338e1ae2-0cf0-5392-84b3-d27fee129c35", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "sha1", "value": "e27e0d0a4b308f9b6b0469159931eb5e343e7ff8", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gorbag\", \"specimen_sha256\": \"9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Workbook delivery and recovered-PE behavior refer to distinct linked specimens.\", \"The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL.\", \"The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "fb2cf0aa-9609-53cc-98c1-6a159cc0c4d3", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "md5", "value": "388374f8478203844f854ffe213f7a47", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gorbag\", \"specimen_sha256\": \"9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Workbook delivery and recovered-PE behavior refer to distinct linked specimens.\", \"The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL.\", \"The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "26e4cc63-ca28-5af8-a505-5670ff05dc86", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "sha256", "value": "49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Match the exact tasking and submission URLs; webhook.site itself is a legitimate service.\", \"Commands delivered by a remote server require their own captured artifacts and execution context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "28c78462-3110-5522-a109-badf8885c51c", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "sha1", "value": "512920c5e31d08d65940877bdb29d0a17738ce37", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Match the exact tasking and submission URLs; webhook.site itself is a legitimate service.\", \"Commands delivered by a remote server require their own captured artifacts and execution context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "55e39c16-8d3e-54a6-85cd-2c4c017172ef", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "md5", "value": "39cc6af95d0425f160571032a6719ad3", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Match the exact tasking and submission URLs; webhook.site itself is a legitimate service.\", \"Commands delivered by a remote server require their own captured artifacts and execution context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "04ae9f33-caf4-5c29-8238-601c522567ed", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" } ], "type": "sha256", "value": "c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"covenant-grunt\", \"specimen_sha256\": \"c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "ec79c2b0-8f9c-555b-a1d2-7146c3825327", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" } ], "type": "sha1", "value": "fbfaff2e2ed7ac6608c1a7bb2055941d54c52a92", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"covenant-grunt\", \"specimen_sha256\": \"c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "df4ba604-84e7-5e7d-a18e-548efd82c72b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" } ], "type": "md5", "value": "3078d19a4860184eaac43cb45622672f", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"covenant-grunt\", \"specimen_sha256\": \"c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "d1b8c64d-a91b-589f-b4b7-f842283e0ed6", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "sha256", "value": "d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"matchboil\", \"specimen_sha256\": \"d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key.\", \"MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "aeef5bbe-2ff6-5d84-a990-8666309b8dc2", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "sha1", "value": "f01698a5e796c1f541e82bf4ff6823f3f72f58a9", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"matchboil\", \"specimen_sha256\": \"d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key.\", \"MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "eea5c0b6-cb0f-585b-b016-9f2915c90b44", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "md5", "value": "eb0da1bf4db13bbb8bc8fbf752274746", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"matchboil\", \"specimen_sha256\": \"d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key.\", \"MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "01ae6184-9a47-5c35-9617-4147960d746a", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "sha256", "value": "708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gamaredon\", \"specimen_sha256\": \"708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"UltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "40e29947-5e09-56a3-87b7-9b4069f7009f", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "sha1", "value": "4a1aa20a1d998235e1dab81f124ce6c6d79656a2", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gamaredon\", \"specimen_sha256\": \"708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"UltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f61a7815-fde8-55e8-aace-8a49cef60b7b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "md5", "value": "9a30c5d73737a637058fcf8468541a2f", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gamaredon\", \"specimen_sha256\": \"708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"UltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "70ce193e-5e7b-5ba3-a2b7-613dc93e9e11", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "sha256", "value": "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"cornflake\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"CornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment.\", \"localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f14176b8-e5ed-59d5-859c-ca3d10b88f93", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "sha1", "value": "510af9bb00ff5d4a6856b1291af55db9f6e13551", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"cornflake\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"CornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment.\", \"localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "4d914eb8-85b1-54c3-9eef-50b867675352", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "md5", "value": "fba867df17721879df9d8dcca68d6900", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"cornflake\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"CornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment.\", \"localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "3214275b-b41b-52db-a5fa-c5852520a36c", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "sha256", "value": "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "41e84d06-4b86-5c30-86be-cffa06510f3d", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "sha1", "value": "937e75e0e1c82eecab69e9b8ad481bd7e0845308", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f7fd1d3c-874f-59ca-95b8-7e77528d7725", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "md5", "value": "c6f4df18cb880500f3921a179c3a3766", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "e9d4eb02-a52d-5a96-a026-10a7acb2bcc5", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "sha256", "value": "78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"prime-reverseshell\", \"specimen_sha256\": \"78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Use the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "20b683a2-b477-5346-8024-93c05936702b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "sha1", "value": "a5e0a82bf6cc302a20d917235643b748f73fcc27", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"prime-reverseshell\", \"specimen_sha256\": \"78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Use the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "0d4e46aa-c046-53dd-b666-0ba4ed637e71", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "md5", "value": "0a178f76c48c038e8bad03a62b52cfc9", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"prime-reverseshell\", \"specimen_sha256\": \"78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Use the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "a57b6716-0fca-5a19-8d20-13d77fd0e19d", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "sha256", "value": "c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"pixynetloader\", \"specimen_sha256\": \"c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "7e2684d1-d869-564e-8457-3ff0b216f55e", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "sha1", "value": "e457641615b548c315913fac7e8255519e50687f", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"pixynetloader\", \"specimen_sha256\": \"c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "72febc9a-300e-540a-81e1-16ad30fff5fc", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "md5", "value": "b077401fe3d9642345d4c3deafa60aa5", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"pixynetloader\", \"specimen_sha256\": \"c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "003cc180-fc81-57b0-a166-1014b9d2b8c5", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "sha256", "value": "d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"dynowiper\", \"specimen_sha256\": \"d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "8ed9144c-aedd-502c-8e3f-e00162af0a53", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "sha1", "value": "69ede7e341fd26fa0577692b601d80cb44778d93", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"dynowiper\", \"specimen_sha256\": \"d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "94db7a9e-3d81-5e00-a1d7-a9a8aa86bf6b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "md5", "value": "c4379da51e8b9e86ec3de934f9373f4a", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"dynowiper\", \"specimen_sha256\": \"d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "0767258a-927f-57ac-ba04-ca6b3a69129a", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lummastealer\"" } ], "type": "sha256", "value": "30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lummastealer\", \"specimen_sha256\": \"30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Available coverage for this specimen is file identity, static metadata and the retrieved reputation graph.\", \"The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "46b76715-f3aa-5c57-b7d9-3a4cc7bdf3a5", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lummastealer\"" } ], "type": "sha1", "value": "1158d28851adc223b7cc93fcc9585381fe53be34", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lummastealer\", \"specimen_sha256\": \"30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Available coverage for this specimen is file identity, static metadata and the retrieved reputation graph.\", \"The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "295bbf9e-7e1a-5315-8ff5-e50242eda7ad", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lummastealer\"" } ], "type": "md5", "value": "3837b2ae95f88ec677f83fa95ac50a79", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lummastealer\", \"specimen_sha256\": \"30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Available coverage for this specimen is file identity, static metadata and the retrieved reputation graph.\", \"The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "1dd6db8f-df87-52c2-9f6d-5225364686fe", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "sha256", "value": "1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"redlinestealer\", \"specimen_sha256\": \"1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f9773a2e-6d82-56cd-90f8-edaf10a90409", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "sha1", "value": "66d0a00577a6e7415cfb21b4cf88805bedc34889", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"redlinestealer\", \"specimen_sha256\": \"1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "01fd8b5b-6c3a-5999-b822-c946808792b4", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "md5", "value": "a5c45448100c2a173f73d339bbee9b47", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"redlinestealer\", \"specimen_sha256\": \"1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "5d5802b7-7859-5378-8e95-be8cdcbf8d06", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "sha256", "value": "99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lockbit\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication.\", \"LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f6367393-ae10-5d49-ae5f-1438b9b6c18b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "sha1", "value": "b2b0244b03e80a3e3b355a535411faf3bf4fce74", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lockbit\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication.\", \"LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f1eb744f-7d9c-5894-a42e-3f3f80b4a116", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "md5", "value": "1dff89c029b823fa2a3b488d4a57affb", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lockbit\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication.\", \"LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "685d8e16-9123-5d89-a5ec-85b4c556f50e", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"vidar\"" } ], "type": "sha256", "value": "d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"vidar\", \"specimen_sha256\": \"d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Vidar is the catalog context. The reported code findings describe the acquired Go artifact.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "00d5e2ef-916c-58ca-8cbc-9555c0625268", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"vidar\"" } ], "type": "sha1", "value": "ccea4b815266482209f16026a128254ddc2a029d", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"vidar\", \"specimen_sha256\": \"d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Vidar is the catalog context. The reported code findings describe the acquired Go artifact.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "b960d958-1af9-560b-bc02-82ca103fa2f6", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"vidar\"" } ], "type": "md5", "value": "39f48fdc2fe7c7bb82cb0c9917201104", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"vidar\", \"specimen_sha256\": \"d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Vidar is the catalog context. The reported code findings describe the acquired Go artifact.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f47960d5-1745-5a1c-97a2-739a51181f29", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "sha256", "value": "0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"stealc\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Stealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators.\", \"Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f4ac4c28-d56f-5e86-a193-2b6e2bb24047", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "sha1", "value": "bc5b95e545b7911a252328ae98bbbd9ea8270e18", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"stealc\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Stealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators.\", \"Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "09147ef2-7864-5df7-a0ab-23b04e643183", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "md5", "value": "bfd9de847fe1fa7e1716cde61c9ac0b0", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"stealc\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Stealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators.\", \"Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "c8290309-e36b-541f-b584-cbdeebe58e1c", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "sha256", "value": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"rhadamanthys\", \"specimen_sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file.\", \"Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "aa4045f1-0514-57cf-b72d-e8cc2cc415e6", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "sha1", "value": "ef2ea8de20d62f06aae88341da12c1b35dd5cb3d", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"rhadamanthys\", \"specimen_sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file.\", \"Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "3d11694e-16a4-52e1-b6a8-ba7a7f4a3fcc", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "md5", "value": "68855abb0d31bd2ff47a95a18ec255c3", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"rhadamanthys\", \"specimen_sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file.\", \"Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "f8748750-e330-5863-baf7-1bd6b9e1cf98", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "sha256", "value": "53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gentlemen\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Ransom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "0f1f74d0-f699-54e2-8f69-9bad6893bbd6", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "sha1", "value": "4cf4ba5a575b8f153cfa34ceef6006436dbbf432", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gentlemen\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Ransom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "ad66d124-d714-5f2f-9c95-059053249c1b", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "md5", "value": "093f63c3a11f9ff01de82f3bbf27be17", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gentlemen\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"role\": \"primary_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Ransom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "c7badbcf-11bb-5855-95b5-a6b985627ef1", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "sha256", "value": "df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gorbag\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"role\": \"derived_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Workbook delivery and recovered-PE behavior refer to distinct linked specimens.\", \"The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL.\", \"The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "5f60aa20-c14a-5abf-b51b-864ebd43e632", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "sha1", "value": "ebcd20d46b40734a03e645779875f1fe87882442", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gorbag\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"role\": \"derived_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Workbook delivery and recovered-PE behavior refer to distinct linked specimens.\", \"The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL.\", \"The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "079c5be6-94b8-5ec5-872b-90f8689e92c2", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "md5", "value": "4f244724e3ac2aae8d39f72e911a9a22", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gorbag\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"role\": \"derived_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Workbook delivery and recovered-PE behavior refer to distinct linked specimens.\", \"The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL.\", \"The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "af8abf45-dc20-52be-9575-dbc279e769d8", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "sha256", "value": "2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a\", \"role\": \"derived_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Match the exact tasking and submission URLs; webhook.site itself is a legitimate service.\", \"Commands delivered by a remote server require their own captured artifacts and execution context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "0d852d0a-e936-58a8-b996-ba37aebf28cd", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "sha1", "value": "f7ce179447d9693adb10341726989b3b016d4360", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a\", \"role\": \"derived_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Match the exact tasking and submission URLs; webhook.site itself is a legitimate service.\", \"Commands delivered by a remote server require their own captured artifacts and execution context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "5fc76685-f8c7-57f9-a437-68687c42785c", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "md5", "value": "cb040464587c7901926169d8e046fad8", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a\", \"role\": \"derived_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 85, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"Match the exact tasking and submission URLs; webhook.site itself is a legitimate service.\", \"Commands delivered by a remote server require their own captured artifacts and execution context.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "823f1f63-d1ef-57f2-a803-370bee571f60", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "sha256", "value": "7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"rhadamanthys\", \"specimen_sha256\": \"7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad\", \"role\": \"alternative_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file.\", \"Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "5d4c5ae5-4b97-55da-a679-5c34e41ec90f", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "sha1", "value": "87596edc57173f151068404152eb50212c768c96", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"rhadamanthys\", \"specimen_sha256\": \"7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad\", \"role\": \"alternative_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file.\", \"Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "74044e28-c979-5d4a-87aa-1d5df0b9421f", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "md5", "value": "73c940e6cb2ff49f8e8c145524c41fd8", "category": "Payload delivery", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"rhadamanthys\", \"specimen_sha256\": \"7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad\", \"role\": \"alternative_sample_identity\", \"assessment\": \"verified_file_identity\", \"confidence\": 70, \"basis\": \"Local hash recomputation; malicious classification bounded by the case evidence and catalog label\", \"match_semantics\": \"exact_hash\", \"evidence_notes\": [\"The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file.\", \"Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\"}], \"live_status\": \"not_applicable\"}", "timestamp": "1794239233" }, { "uuid": "6b76ce52-5edf-5c12-bdca-e699c4b1442a", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "ip-dst|port", "value": "213.145.86.112|443", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"configured_https_server\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"Literal bytes independently verified; data flow described by Caronte\", \"match_semantics\": \"destination_and_port\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-6d993766b699a06e\", \"ev-d05642c116cb5a1d\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "9a766e84-4e72-5672-84a4-1df08c518828", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "url", "value": "https://213.145.86.112/t/pixel.gif", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"configured_beacon_path\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"Host and path literals independently verified in the acquired script; use described by the retained Caronte report\", \"match_semantics\": \"url_path_with_optional_query\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-6d993766b699a06e\", \"ev-d05642c116cb5a1d\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "d2e535f9-f518-529c-9298-da69a6a4cd57", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "url", "value": "https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"configured_stage_download\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"Host and path literals independently verified in the acquired script; use described by the retained Caronte report\", \"match_semantics\": \"url_path_with_optional_query\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-060d3fa994170bc8\", \"ev-6d993766b699a06e\", \"ev-d05642c116cb5a1d\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "beb1f40d-330f-5172-a1b3-78e7fb60af37", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "url", "value": "https://213.145.86.112/cdn/chunks/vendor-9f3a1c.min.js", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"configured_stage_download\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"Host and path literals independently verified in the acquired script; use described by the retained Caronte report\", \"match_semantics\": \"url_path_with_optional_query\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-fd3bbb95718907fc\", \"ev-6d993766b699a06e\", \"ev-d05642c116cb5a1d\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "38047a3b-470c-50a2-9814-e4ad72baa98d", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "url", "value": "https://213.145.86.112/t/event", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"chocoshell\", \"specimen_sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\", \"role\": \"configured_result_submission\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"Host and path literals independently verified in the acquired script; use described by the retained Caronte report\", \"match_semantics\": \"url_path_with_optional_query\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-33690425113a2204\", \"ev-6d993766b699a06e\", \"ev-d05642c116cb5a1d\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "74549995-4eaa-5539-b813-9e8c42202eb4", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "ip-dst|port", "value": "89.44.9.186|3240", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"prime-reverseshell\", \"specimen_sha256\": \"78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8\", \"role\": \"configured_reverse_shell_destination\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 80, \"basis\": \"Caronte traced decoded value to TcpClient\", \"match_semantics\": \"destination_and_port\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-f47337f8d44979ae\", \"ev-8e0e1c7b104eb74f\", \"ev-e923b63a52644dac\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "485911df-cb97-57cb-af11-457ca1db9278", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "hostname|port", "value": "seemsurprise.com|443", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"gamaredon\", \"specimen_sha256\": \"708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73\", \"role\": \"configured_reverse_vnc_destination\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 80, \"basis\": \"Caronte recovered launcher connection argument\", \"match_semantics\": \"destination_and_port\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\"], \"evidence_ids\": [\"ev-62db807579bde9e3\", \"ev-f2eead1925646947\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "c0afd58b-bf00-5420-b9d7-3ef3bea412d6", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "url", "value": "https://webhook.site/82911ae6-ea27-4996-a664-2322e89da9ae", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\", \"role\": \"configured_task_retrieval\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"Locally reconstructed batch; independently analyzed by Caronte\", \"match_semantics\": \"exact_url\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\", \"Match the exact webhook URL and its tasking or result-submission role; the hosting service is legitimate.\"], \"evidence_ids\": [\"ev-a02ad2820e607fce\", \"ev-380d1f8d1c7621a1\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "f3d11331-49c1-5ed4-98b7-54081240c003", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "url", "value": "https://webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"hookedge\", \"specimen_sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\", \"role\": \"configured_result_submission\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"HTML form action in statically extracted original VBA\", \"match_semantics\": \"exact_url\", \"evidence_notes\": [\"Correlate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\", \"Match the exact webhook URL and its tasking or result-submission role; the hosting service is legitimate.\"], \"evidence_ids\": [], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "b0930c77-eda1-515e-a9d9-26ff14ace552", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "url", "value": "https://docrack.me", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lockbit\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"role\": \"https_execution_gate\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"UTF-16LE URL independently verified at decimal file offset 236048 in the hash-verified specimen. Caronte traces WinHTTP GET and a 2xx status check before encryption.\", \"match_semantics\": \"exact_url\", \"evidence_notes\": [\"The HTTPS status gates execution. This record does not assert successful encryption on a victim or a currently active command service.\", \"LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\"], \"evidence_ids\": [\"ev-14ba17e1bbdc0bbc\", \"ev-5a4cdbbc037dcc91\", \"ev-78c130645c95833f\", \"ev-7b9e330f57409071\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware\"}, {\"source_name\": \"Independent literal verification\", \"url\": \"https://beelzebub.ai/feeds/russia-malware-2026-11-09/lockbit-endpoint-verification.json\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "05b6ae91-43a0-52b7-9229-fcc9d3d71d12", "Tag": [ { "name": "beelzebub:record=\"reviewed-indicator\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "hostname|port", "value": "docrack.me|443", "category": "Network activity", "to_ids": false, "distribution": "5", "disable_correlation": false, "comment": "{\"case_id\": \"lockbit\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"role\": \"https_execution_gate\", \"assessment\": \"reviewed_static_configuration\", \"confidence\": 85, \"basis\": \"UTF-16LE URL independently verified at decimal file offset 236048 in the hash-verified specimen. Caronte traces WinHTTP GET and a 2xx status check before encryption.\", \"match_semantics\": \"destination_and_port\", \"evidence_notes\": [\"The HTTPS status gates execution. This record does not assert successful encryption on a victim or a currently active command service.\", \"LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\"], \"evidence_ids\": [\"ev-14ba17e1bbdc0bbc\", \"ev-78c130645c95833f\"], \"source_references\": [{\"source_name\": \"MalwareBazaar\", \"url\": \"https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\"}, {\"source_name\": \"Public research and attribution\", \"url\": \"https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware\"}, {\"source_name\": \"Independent literal verification\", \"url\": \"https://beelzebub.ai/feeds/russia-malware-2026-11-09/lockbit-endpoint-verification.json\"}], \"live_status\": \"not_revalidated\"}", "timestamp": "1794239233" }, { "uuid": "288cea8f-d932-589e-b8e7-bf9f5e6ef13a", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" } ], "type": "text", "value": "file_path: %appdata%\\Microsoft\\Network\\Cache\\icon.png", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--c2622b90-2eeb-5c21-93a8-467c800c0c41\", \"case_id\": \"covenant-grunt\", \"type\": \"file_path\", \"value\": \"%appdata%\\\\Microsoft\\\\Network\\\\Cache\\\\icon.png\", \"display_value\": \"%appdata%\\\\Microsoft\\\\Network\\\\Cache\\\\icon.png\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7c7f54e8637c890c\", \"ev-ea3c6f518f3d32ea\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b54342fa-4120-5eb9-9b52-e9ed6518de2f", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" } ], "type": "text", "value": "mutex: resolvefree", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--42a21a91-a18c-5076-8560-e52a2115dde0\", \"case_id\": \"covenant-grunt\", \"type\": \"mutex\", \"value\": \"resolvefree\", \"display_value\": \"resolvefree\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7c7f54e8637c890c\", \"ev-d6e7f138dba9839f\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "198f6afb-5749-5cc5-afbf-dc43e836faeb", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "process_name: regsvr32.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\", \"pixynetloader\"], \"assessment\": [\"context_only\", \"context_only\"], \"observations\": [{\"id\": \"observable--791f4d8f-037e-50d1-a7c6-776a588d8ad6\", \"case_id\": \"covenant-grunt\", \"type\": \"process_name\", \"value\": \"regsvr32.exe\", \"display_value\": \"regsvr32.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7c7f54e8637c890c\", \"ev-bcf2718539a43e26\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}, {\"id\": \"observable--34bfa89a-4f25-5e85-a7db-5631f977c333\", \"case_id\": \"pixynetloader\", \"type\": \"process_name\", \"value\": \"regsvr32.exe\", \"display_value\": \"regsvr32.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6a8ceb0c34bbc313\", \"ev-c4f8c4490862f855\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "0f99c406-ff8e-54b8-80ce-511f7052cfba", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "process_name: explorer.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\", \"pixynetloader\"], \"assessment\": [\"context_only\", \"context_only\"], \"observations\": [{\"id\": \"observable--0b008a27-031a-59ff-ae09-7f6ce5a627d3\", \"case_id\": \"covenant-grunt\", \"type\": \"process_name\", \"value\": \"explorer.exe\", \"display_value\": \"explorer.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7c7f54e8637c890c\", \"ev-bcf2718539a43e26\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}, {\"id\": \"observable--930872f3-059f-5d82-858f-4363f57184e2\", \"case_id\": \"pixynetloader\", \"type\": \"process_name\", \"value\": \"explorer.exe\", \"display_value\": \"explorer.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6a8ceb0c34bbc313\", \"ev-c4f8c4490862f855\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "52810a48-822e-52d8-84e3-4215f88bbbc9", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" } ], "type": "text", "value": "file_path: IDStore.dll", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--c705320e-2519-5671-a15e-e4e173571cbd\", \"case_id\": \"covenant-grunt\", \"type\": \"file_path\", \"value\": \"IDStore.dll\", \"display_value\": \"IDStore.dll\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7c7f54e8637c890c\", \"ev-bcf2718539a43e26\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "6bf760da-f253-5c28-a2a0-9bb7cb035f3a", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "other: 838645f4bab7458fb130c7120a500982", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\", \"pixynetloader\"], \"assessment\": [\"embedded_constant\", \"embedded_constant\"], \"observations\": [{\"id\": \"observable--93e99912-a747-5b4a-8494-50325f4ee596\", \"case_id\": \"covenant-grunt\", \"type\": \"other\", \"value\": \"838645f4bab7458fb130c7120a500982\", \"display_value\": \"838645f4bab7458fb130c7120a500982\", \"assessment\": \"embedded_constant\", \"interpretation\": \"Cryptographic or configuration constant reported in code; this is not a file hash.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7c7f54e8637c890c\", \"ev-ea3c6f518f3d32ea\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}, {\"id\": \"observable--0e7c018d-9813-5b9b-b033-47a5a88dc49a\", \"case_id\": \"pixynetloader\", \"type\": \"other\", \"value\": \"838645f4bab7458fb130c7120a500982\", \"display_value\": \"838645f4bab7458fb130c7120a500982\", \"assessment\": \"embedded_constant\", \"interpretation\": \"Cryptographic or configuration constant reported in code; this is not a file hash.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-062ae76c159ca800\", \"ev-e937bcd5b414c9db\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "cc3d1a50-bb02-5ce4-8e63-948109cf53a1", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"covenant-grunt\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "other: HIDE", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"covenant-grunt\", \"pixynetloader\"], \"assessment\": [\"context_only\", \"context_only\"], \"observations\": [{\"id\": \"observable--8739590c-f918-5c63-baca-23d5049a96a3\", \"case_id\": \"covenant-grunt\", \"type\": \"other\", \"value\": \"HIDE\", \"display_value\": \"HIDE\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-ea3c6f518f3d32ea\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}, {\"id\": \"observable--8f3fd084-3468-5f9c-8f21-e8c8e083872c\", \"case_id\": \"pixynetloader\", \"type\": \"other\", \"value\": \"HIDE\", \"display_value\": \"HIDE\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-062ae76c159ca800\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "6880f625-4d93-5a7d-be4b-f1d2ce3d59e8", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "text", "value": "process_name: Yhosh.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"matchboil\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--7376d0c2-fb7e-5140-9328-2b22748902fe\", \"case_id\": \"matchboil\", \"type\": \"process_name\", \"value\": \"Yhosh.exe\", \"display_value\": \"Yhosh.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-13f29fe3fa2ef4dd\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "1f0a0a9d-79a3-5b00-91fb-221f1fa589a2", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "text", "value": "debug_guid: 33049a21-567a-4652-baa1-05ca846616e1", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"matchboil\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--ecf29879-d25a-5d9c-844a-cab9fe7676b0\", \"case_id\": \"matchboil\", \"type\": \"debug_guid\", \"value\": \"33049a21-567a-4652-baa1-05ca846616e1\", \"display_value\": \"33049a21-567a-4652-baa1-05ca846616e1\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-85e77897e56c400a\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "7d6e5788-fd2b-5f8f-b841-f72d67dba9a6", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "text", "value": "other: 086c61a26785db09c1f87ce1eb106d649022b9889b9d5a45c6719fdc988799d0", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"matchboil\"], \"assessment\": [\"embedded_constant\"], \"observations\": [{\"id\": \"observable--ec549163-2dd4-51ea-9c0b-7b88f803ef32\", \"case_id\": \"matchboil\", \"type\": \"other\", \"value\": \"086c61a26785db09c1f87ce1eb106d649022b9889b9d5a45c6719fdc988799d0\", \"display_value\": \"086c61a26785db09c1f87ce1eb106d649022b9889b9d5a45c6719fdc988799d0\", \"assessment\": \"embedded_constant\", \"interpretation\": \"Cryptographic or configuration constant reported in code; this is not a file hash.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-35395a10791abdf7\", \"ev-f33021e22ca05df7\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "6adeef61-cac0-5828-8f4d-0ceec5ea81c8", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "text", "value": "other: 583f64bd6f32ca771cb7cb1a95aa8a12", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"matchboil\"], \"assessment\": [\"embedded_constant\"], \"observations\": [{\"id\": \"observable--ea769150-014c-596c-8b26-95751bc39f65\", \"case_id\": \"matchboil\", \"type\": \"other\", \"value\": \"583f64bd6f32ca771cb7cb1a95aa8a12\", \"display_value\": \"583f64bd6f32ca771cb7cb1a95aa8a12\", \"assessment\": \"embedded_constant\", \"interpretation\": \"Cryptographic or configuration constant reported in code; this is not a file hash.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-35395a10791abdf7\", \"ev-f33021e22ca05df7\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "88a2722e-bec0-5f11-ae95-3e478f897bf5", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"matchboil\"" } ], "type": "text", "value": "other: 5171A332-8373-4159-B89B-05F3AE0920B8", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"matchboil\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--b5b59788-879e-5143-a3e3-e8f644730739\", \"case_id\": \"matchboil\", \"type\": \"other\", \"value\": \"5171A332-8373-4159-B89B-05F3AE0920B8\", \"display_value\": \"5171A332-8373-4159-B89B-05F3AE0920B8\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-3d2aa4b41f1a11f6\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "d56abcca-e972-55ed-856a-89d033ec5f19", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Adobe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--2e1cd488-532e-5659-b34e-ac9f58e4d16a\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Adobe\", \"display_value\": \"%APPDATA%\\\\Adobe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6563b75c44e57e0f\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "59ea3537-b2da-588b-afa5-b1dc04bc2e2f", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Adobe\\68083.cmd", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--40ef7251-d53e-5ca0-9269-af8951318c1b\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Adobe\\\\68083.cmd\", \"display_value\": \"%APPDATA%\\\\Adobe\\\\68083.cmd\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6563b75c44e57e0f\", \"ev-62db807579bde9e3\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "1f4398ed-d6db-5790-a162-d1b69751c7f0", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "process_name: explorerr.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--90d98482-667a-55d8-9363-304c2d03c1eb\", \"case_id\": \"gamaredon\", \"type\": \"process_name\", \"value\": \"explorerr.exe\", \"display_value\": \"explorerr.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-62db807579bde9e3\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "e4355957-6c9c-54f0-b44b-ffc009e016e5", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: FwYmY8YvYxYMYVYi.ini", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--f5db634c-7781-5d7b-b2d2-5989c52e9750\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"FwYmY8YvYxYMYVYi.ini\", \"display_value\": \"FwYmY8YvYxYMYVYi.ini\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2ad07e1619608216\", \"ev-62db807579bde9e3\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "bd03a3dc-eb57-5ec3-adcc-5971c9eb5557", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: UltraVNC.ini", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--afbe9059-fad7-56fc-9195-3121b0a240fb\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"UltraVNC.ini\", \"display_value\": \"UltraVNC.ini\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2ad07e1619608216\", \"ev-e0e736767b988ae5\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "ca3181ca-a0a1-5fbb-b970-c42d0ff21296", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: rc4.key", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--fdd4f2a7-4fcf-570d-96d3-f4fe4fb6053e\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"rc4.key\", \"display_value\": \"rc4.key\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2ad07e1619608216\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "70b0b779-290d-5866-8ade-a8e615e33589", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: MSRC4Plugin_for_sc.dsm", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--31480d36-32d7-5729-a04f-b7f81e48d93e\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"MSRC4Plugin_for_sc.dsm\", \"display_value\": \"MSRC4Plugin_for_sc.dsm\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2ad07e1619608216\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "210e875b-fd64-5be7-b0fd-2fa84e952f5d", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "file_path: 1.docx", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--4f554f15-3c65-54c0-b52b-7dfb495b84b0\", \"case_id\": \"gamaredon\", \"type\": \"file_path\", \"value\": \"1.docx\", \"display_value\": \"1.docx\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2ad07e1619608216\", \"ev-62db807579bde9e3\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "4a3c4c28-f6df-5273-b936-29ef013dfd6f", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "mutex: WinVNC_Win32_Instance_Mutex", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--2ef584ef-c31f-57cf-a896-4df9e5b664f2\", \"case_id\": \"gamaredon\", \"type\": \"mutex\", \"value\": \"WinVNC_Win32_Instance_Mutex\", \"display_value\": \"WinVNC_Win32_Instance_Mutex\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-e0e736767b988ae5\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "ca4bb4f3-ebaa-5d3f-b23a-5ec961e002fd", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "other: A7F8FC867315B7FF5F", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--716332ac-2aef-5b0c-8df4-fa5d3fdb92c3\", \"case_id\": \"gamaredon\", \"type\": \"other\", \"value\": \"A7F8FC867315B7FF5F\", \"display_value\": \"A7F8FC867315B7FF5F\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-e0e736767b988ae5\", \"ev-62db807579bde9e3\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "bbddb759-270f-535c-aac4-41317c8a053c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gamaredon\"" } ], "type": "text", "value": "other: 7ZSfx%03x.cmd", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gamaredon\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--f3b1489d-675a-5349-b56d-98dd131eb567\", \"case_id\": \"gamaredon\", \"type\": \"other\", \"value\": \"7ZSfx%03x.cmd\", \"display_value\": \"7ZSfx%03x.cmd\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-b3b30112b1d84cca\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "5ebd3d36-b4c9-58c7-b9b8-0c0c17971577", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "registry_key: HKCU:\\Environment\\windir", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--5450a035-058b-5f42-a9d3-654c174496e4\", \"case_id\": \"chocoshell\", \"type\": \"registry_key\", \"value\": \"HKCU:\\\\Environment\\\\windir\", \"display_value\": \"HKCU:\\\\Environment\\\\windir\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "298a71c2-bcc4-5e5e-af39-a35bf2939bfd", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "registry_key: HKCU:\\Software\\Classes\\AppX3xxs313wwkfjhythsb8q46xdsvu8p2v\\Shell\\open\\command", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--c49986a3-724b-5788-b8ba-4e7e7b700b8a\", \"case_id\": \"chocoshell\", \"type\": \"registry_key\", \"value\": \"HKCU:\\\\Software\\\\Classes\\\\AppX3xxs313wwkfjhythsb8q46xdsvu8p2v\\\\Shell\\\\open\\\\command\", \"display_value\": \"HKCU:\\\\Software\\\\Classes\\\\AppX3xxs313wwkfjhythsb8q46xdsvu8p2v\\\\Shell\\\\open\\\\command\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6f125ae18b73bc04\", \"ev-d05642c116cb5a1d\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "f79429f3-d45d-5c4b-a34e-e23c8c5c6b33", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "registry_key: HKCU:\\Software\\Classes\\Folder\\shell\\open\\command", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--bc7356ba-0033-5931-a34a-670a6569f45b\", \"case_id\": \"chocoshell\", \"type\": \"registry_key\", \"value\": \"HKCU:\\\\Software\\\\Classes\\\\Folder\\\\shell\\\\open\\\\command\", \"display_value\": \"HKCU:\\\\Software\\\\Classes\\\\Folder\\\\shell\\\\open\\\\command\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6f125ae18b73bc04\", \"ev-d05642c116cb5a1d\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "8845bc7e-fe40-5745-ad70-fdb72a01966d", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %LOCALAPPDATA%\\Google\\Chrome\\User Data", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--0024cc2c-2c02-575a-bee6-2b7fa53a6fe2\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%LOCALAPPDATA%\\\\Google\\\\Chrome\\\\User Data\", \"display_value\": \"%LOCALAPPDATA%\\\\Google\\\\Chrome\\\\User Data\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d05642c116cb5a1d\", \"ev-f7449df6d65d3887\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b91a0a7d-560b-5e50-a7f9-a9c1e6b1c089", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %LOCALAPPDATA%\\Microsoft\\Edge\\User Data", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--f30a882a-b883-5bb1-8f63-c7a45c6831e9\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%LOCALAPPDATA%\\\\Microsoft\\\\Edge\\\\User Data\", \"display_value\": \"%LOCALAPPDATA%\\\\Microsoft\\\\Edge\\\\User Data\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d05642c116cb5a1d\", \"ev-f7449df6d65d3887\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "8670fa3e-442c-50f2-94f5-6098c6f61f38", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--bf0c61f0-1048-5654-ad5c-ec29f25681dd\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%LOCALAPPDATA%\\\\BraveSoftware\\\\Brave-Browser\\\\User Data\", \"display_value\": \"%LOCALAPPDATA%\\\\BraveSoftware\\\\Brave-Browser\\\\User Data\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d05642c116cb5a1d\", \"ev-f7449df6d65d3887\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "301f833e-898b-5bb7-a095-23bc1e72bf8d", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Opera Software\\Opera Stable", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--7514461b-a247-5fa7-a7e0-c866bbb1f752\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Opera Software\\\\Opera Stable\", \"display_value\": \"%APPDATA%\\\\Opera Software\\\\Opera Stable\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b970fb3b-8a64-591c-a7dd-cd00d497405e", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Opera Software\\Opera GX Stable", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--80c39415-e5b2-54c7-9419-aac7ac5b6cf6\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Opera Software\\\\Opera GX Stable\", \"display_value\": \"%APPDATA%\\\\Opera Software\\\\Opera GX Stable\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "4aef1eec-5a25-5734-be89-b35c9c207c87", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %LOCALAPPDATA%\\Vivaldi\\User Data", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--539b33ac-4d0f-5960-bddf-29c677a2cbc3\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%LOCALAPPDATA%\\\\Vivaldi\\\\User Data\", \"display_value\": \"%LOCALAPPDATA%\\\\Vivaldi\\\\User Data\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "d4fbd8c2-8d18-51ae-b5aa-15e0062c9227", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Mozilla\\Firefox\\Profiles", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--eb18e134-3414-59f3-b5a0-66be585c446a\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Mozilla\\\\Firefox\\\\Profiles\", \"display_value\": \"%APPDATA%\\\\Mozilla\\\\Firefox\\\\Profiles\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "2458a33d-03d1-52b3-9a19-65dc1c44060c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Waterfox\\Profiles", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--98826143-c976-5103-add6-a4c2a2c40009\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Waterfox\\\\Profiles\", \"display_value\": \"%APPDATA%\\\\Waterfox\\\\Profiles\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "d26a401e-e4bc-5fcf-9c6a-e060f0f8912a", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %LOCALAPPDATA%\\LibreWolf\\Profiles", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--0d8fdd96-99aa-5afa-a680-98618687c86d\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%LOCALAPPDATA%\\\\LibreWolf\\\\Profiles\", \"display_value\": \"%LOCALAPPDATA%\\\\LibreWolf\\\\Profiles\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "4f034dcd-6cdf-52f4-a9f4-94674ab42a5d", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %APPDATA%\\Floorp\\Profiles", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--16c0c216-c29f-557e-9b49-3e7b6f562513\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\Floorp\\\\Profiles\", \"display_value\": \"%APPDATA%\\\\Floorp\\\\Profiles\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "4f4593c3-b253-5096-bf1b-7da3267a42b3", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %APPDATA%\\zen\\Profiles", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--37716246-675b-506c-b399-c2850bdc3fc8\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%APPDATA%\\\\zen\\\\Profiles\", \"display_value\": \"%APPDATA%\\\\zen\\\\Profiles\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b30e62ed-8102-5e0a-a3da-64ef69074cb6", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "file_path: %LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--6a68e6f6-1a03-5f8a-a922-f13f079bba57\", \"case_id\": \"chocoshell\", \"type\": \"file_path\", \"value\": \"%LOCALAPPDATA%\\\\Microsoft\\\\TokenBroker\\\\Cache\", \"display_value\": \"%LOCALAPPDATA%\\\\Microsoft\\\\TokenBroker\\\\Cache\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "2a4c3551-13aa-51ea-9f82-c88b3fde4db4", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "process_name: ConfigurationRemotingServer", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--7641df21-eb50-5341-8931-0f6ec729a054\", \"case_id\": \"chocoshell\", \"type\": \"process_name\", \"value\": \"ConfigurationRemotingServer\", \"display_value\": \"ConfigurationRemotingServer\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-060d3fa994170bc8\", \"ev-beb5bfcd78c4872b\", \"ev-d05642c116cb5a1d\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "cf00c486-9aed-55fa-b6f6-cadf3dd4db8a", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "process_name: wsreset.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--a9b9daf5-1812-5a64-a121-eedfd20689ea\", \"case_id\": \"chocoshell\", \"type\": \"process_name\", \"value\": \"wsreset.exe\", \"display_value\": \"wsreset.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6f125ae18b73bc04\", \"ev-d05642c116cb5a1d\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "1ee302db-6939-5949-ad24-9bcba93189ca", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "process_name: sdclt.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--0d9fb9af-b122-5645-b5b4-d37082176378\", \"case_id\": \"chocoshell\", \"type\": \"process_name\", \"value\": \"sdclt.exe\", \"display_value\": \"sdclt.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6f125ae18b73bc04\", \"ev-d05642c116cb5a1d\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "dbb0d626-f5c5-519f-b074-98975115d64b", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"chocoshell\"" } ], "type": "text", "value": "process_name: taskkill.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"chocoshell\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--aa9f7d2d-b666-58ee-9774-90b9c82dfe3f\", \"case_id\": \"chocoshell\", \"type\": \"process_name\", \"value\": \"taskkill.exe\", \"display_value\": \"taskkill.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-48142049a03fb1f0\", \"ev-d05642c116cb5a1d\", \"ev-f7449df6d65d3887\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "20c5cf57-509e-5bf2-9159-047e37debce5", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "text", "value": "ip: 196.241.202.107", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"prime-reverseshell\"], \"assessment\": [\"unused_or_decoy_literal\"], \"observations\": [{\"id\": \"observable--cb1ae255-038a-5b09-9c31-1749379af36e\", \"case_id\": \"prime-reverseshell\", \"type\": \"ip\", \"value\": \"196.241.202.107\", \"display_value\": \"196[.]241[.]202[.]107\", \"assessment\": \"unused_or_decoy_literal\", \"interpretation\": \"Literal not linked to the traced TcpClient destination. The 127.0.0.0/8 range is loopback; retain as context.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-e923b63a52644dac\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": 1647}]}" }, { "uuid": "d1341672-4888-5cc2-8c6b-8999db19161b", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "text", "value": "ip: 127.53.10.21", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"prime-reverseshell\"], \"assessment\": [\"unused_or_decoy_literal\"], \"observations\": [{\"id\": \"observable--812bcafc-0915-5694-a634-c60981aaeea3\", \"case_id\": \"prime-reverseshell\", \"type\": \"ip\", \"value\": \"127.53.10.21\", \"display_value\": \"127[.]53[.]10[.]21\", \"assessment\": \"unused_or_decoy_literal\", \"interpretation\": \"Literal not linked to the traced TcpClient destination. The 127.0.0.0/8 range is loopback; retain as context.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-e923b63a52644dac\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": 480}]}" }, { "uuid": "d9f578a2-d86a-58f0-bd92-f86b0da8006b", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "domain: ipinfo.io", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"prime-reverseshell\", \"redlinestealer\"], \"assessment\": [\"legitimate_shared_service\", \"legitimate_shared_service\"], \"observations\": [{\"id\": \"observable--f93aa73c-f42e-5ae4-9bb7-61cd0965cd08\", \"case_id\": \"prime-reverseshell\", \"type\": \"domain\", \"value\": \"ipinfo.io\", \"display_value\": \"ipinfo[.]io\", \"assessment\": \"legitimate_shared_service\", \"interpretation\": \"Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-f47337f8d44979ae\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}, {\"id\": \"observable--2a05afb5-13a5-5eda-9354-ede9a54f3251\", \"case_id\": \"redlinestealer\", \"type\": \"domain\", \"value\": \"ipinfo.io\", \"display_value\": \"ipinfo[.]io\", \"assessment\": \"legitimate_shared_service\", \"interpretation\": \"Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "7d016413-b22a-5f4b-8ccc-ce9288484aa8", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "text", "value": "file_path: nnnnrth.ps1", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"prime-reverseshell\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--08196e87-67a0-515d-b631-37ebfab9165e\", \"case_id\": \"prime-reverseshell\", \"type\": \"file_path\", \"value\": \"nnnnrth.ps1\", \"display_value\": \"nnnnrth.ps1\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7a0911a412865b76\", \"ev-4913eaab3a843778\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "737ac1d0-e482-513e-88ab-ea1e9ae45c6d", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"prime-reverseshell\"" } ], "type": "text", "value": "process_name: Windows Telemetry.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"prime-reverseshell\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--1a9d9aa1-5cd2-5b33-8c61-2f61c690c6c4\", \"case_id\": \"prime-reverseshell\", \"type\": \"process_name\", \"value\": \"Windows Telemetry.exe\", \"display_value\": \"Windows Telemetry.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-7a0911a412865b76\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b27af5ab-174b-5865-adae-e877fbb8b170", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "file_path: %programdata%\\Microsoft\\DeviceSync\\EdgeSync\\EdgeLogo.png", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"pixynetloader\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--46341822-4ba0-5ac1-96bc-883ac302b2f4\", \"case_id\": \"pixynetloader\", \"type\": \"file_path\", \"value\": \"%programdata%\\\\Microsoft\\\\DeviceSync\\\\EdgeSync\\\\EdgeLogo.png\", \"display_value\": \"%programdata%\\\\Microsoft\\\\DeviceSync\\\\EdgeSync\\\\EdgeLogo.png\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-6a8ceb0c34bbc313\", \"ev-914c61ff96afdb28\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "fed0fb1a-bc04-585e-8a62-794eeccd7c71", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "file_path: EdgeSyncPr.dll", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"pixynetloader\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--dfc92a5e-d419-5a75-b660-87eaa27a3d55\", \"case_id\": \"pixynetloader\", \"type\": \"file_path\", \"value\": \"EdgeSyncPr.dll\", \"display_value\": \"EdgeSyncPr.dll\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-772a293ac92f956f\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "a379c8fb-28b9-54ea-877c-15b04afeb31a", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"pixynetloader\"" } ], "type": "text", "value": "file_path: stobject.dll", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"pixynetloader\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--7bb52dcd-34df-54fa-a1e0-61c285585743\", \"case_id\": \"pixynetloader\", \"type\": \"file_path\", \"value\": \"stobject.dll\", \"display_value\": \"stobject.dll\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-c4f8c4490862f855\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "fd6a86df-6645-5199-b04d-0d43465e644c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "text", "value": "pdb_path: C:\\Users\\vagrant\\Documents\\Visual Studio 2013\\Projects\\Source\\Release\\Source.pdb", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"dynowiper\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--8b2c8a22-53d5-5461-a632-d30fb89f2699\", \"case_id\": \"dynowiper\", \"type\": \"pdb_path\", \"value\": \"C:\\\\Users\\\\vagrant\\\\Documents\\\\Visual Studio 2013\\\\Projects\\\\Source\\\\Release\\\\Source.pdb\", \"display_value\": \"C:\\\\Users\\\\vagrant\\\\Documents\\\\Visual Studio 2013\\\\Projects\\\\Source\\\\Release\\\\Source.pdb\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "0f50a4fb-d695-5713-a70f-0a1104142fad", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "text", "value": "other: Directory exclusion list: system32, windows, program files, program files(x86), temp, recycle.bin, $recycle.bin, boot, perflogs, appdata, documents and settings", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"dynowiper\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--2a6de03b-ba37-551d-a675-391e54a7f81e\", \"case_id\": \"dynowiper\", \"type\": \"other\", \"value\": \"Directory exclusion list: system32, windows, program files, program files(x86), temp, recycle.bin, $recycle.bin, boot, perflogs, appdata, documents and settings\", \"display_value\": \"Directory exclusion list: system32, windows, program files, program files(x86), temp, recycle.bin, $recycle.bin, boot, perflogs, appdata, documents and settings\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-b82bd69690e9abef\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "5683d76f-33eb-5a29-88c3-1df16ba69afa", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "text", "value": "other: SystemFunction036", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"dynowiper\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--bfbd4552-6efb-592d-b374-169a086ca901\", \"case_id\": \"dynowiper\", \"type\": \"other\", \"value\": \"SystemFunction036\", \"display_value\": \"SystemFunction036\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d5069192b9fd0a9c\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "25f28b25-080c-56c0-8ae1-2ed4ab7ccca1", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"dynowiper\"" } ], "type": "text", "value": "debug_guid: 9BA97AD6-2A69-4035-860A-67CD1ED799E5", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"dynowiper\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--58342817-6070-5390-8a26-0db659b5eec4\", \"case_id\": \"dynowiper\", \"type\": \"debug_guid\", \"value\": \"9BA97AD6-2A69-4035-860A-67CD1ED799E5\", \"display_value\": \"9BA97AD6-2A69-4035-860A-67CD1ED799E5\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "ac4fcc97-5e2f-5f56-9341-e4e846d3840f", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "ip: 194.156.79.165", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"candidate_unverified\"], \"observations\": [{\"id\": \"observable--df94230a-8821-5236-8aca-87a4ca8bbc67\", \"case_id\": \"redlinestealer\", \"type\": \"ip\", \"value\": \"194.156.79.165\", \"display_value\": \"194[.]156[.]79[.]165\", \"assessment\": \"candidate_unverified\", \"interpretation\": \"Endpoint candidate according to the final recovery-validation state; retained as context rather than a detection indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d751e9432d6dced1\", \"ev-9aa682b580c2c0e0\", \"ev-1e45527a0c9b1962\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": 55615}]}" }, { "uuid": "a5fd544f-afff-5cb3-b142-10f7f6d2e84b", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "url: http://194.156.79.165:55615/", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"candidate_unverified\"], \"observations\": [{\"id\": \"observable--68d6e4d9-7c2a-5dcb-9fd0-8279e82bcf38\", \"case_id\": \"redlinestealer\", \"type\": \"url\", \"value\": \"http://194.156.79.165:55615/\", \"display_value\": \"hxxp://194[.]156[.]79[.]165:55615/\", \"assessment\": \"candidate_unverified\", \"interpretation\": \"Endpoint candidate according to the final recovery-validation state; retained as context rather than a detection indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d751e9432d6dced1\", \"ev-1e45527a0c9b1962\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": 55615}]}" }, { "uuid": "bd4a966f-628f-50eb-968b-84ecbcab15c9", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "domain: api.ipify.org", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"legitimate_shared_service\"], \"observations\": [{\"id\": \"observable--13729841-8808-55dd-8759-af5cc6e1a46b\", \"case_id\": \"redlinestealer\", \"type\": \"domain\", \"value\": \"api.ipify.org\", \"display_value\": \"api[.]ipify[.]org\", \"assessment\": \"legitimate_shared_service\", \"interpretation\": \"Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "4f65726a-9d27-5517-901c-1b53b07e75df", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "domain: api.ip.sb", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"legitimate_shared_service\"], \"observations\": [{\"id\": \"observable--d71988b4-b954-5f71-a45a-02ee998b44fa\", \"case_id\": \"redlinestealer\", \"type\": \"domain\", \"value\": \"api.ip.sb\", \"display_value\": \"api[.]ip[.]sb\", \"assessment\": \"legitimate_shared_service\", \"interpretation\": \"Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "e656c91b-58e9-518e-8b32-adfeb58f3a5b", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "other: cheat", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--cb6a626c-a7e0-5c37-83e9-f2dd9eed666c\", \"case_id\": \"redlinestealer\", \"type\": \"other\", \"value\": \"cheat\", \"display_value\": \"cheat\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d751e9432d6dced1\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b6c1fc74-4e3c-56b1-af6a-9a63255a59fa", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "registry_key: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--a5ff82fa-fa5a-58a0-a1af-939bf801bd70\", \"case_id\": \"redlinestealer\", \"type\": \"registry_key\", \"value\": \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\", \"display_value\": \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "dcf66f36-433e-5b17-83f7-c291cf94bcd4", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "registry_key: SOFTWARE\\Clients\\StartMenuInternet", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--5babe13e-31f1-52fd-b62c-42decb0d34dd\", \"case_id\": \"redlinestealer\", \"type\": \"registry_key\", \"value\": \"SOFTWARE\\\\Clients\\\\StartMenuInternet\", \"display_value\": \"SOFTWARE\\\\Clients\\\\StartMenuInternet\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b05ccd63-83a8-5b00-97f4-ae14680739bb", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "registry_key: Software\\Valve\\Steam", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--cb8d0108-804e-5e16-8192-e0593d6c304e\", \"case_id\": \"redlinestealer\", \"type\": \"registry_key\", \"value\": \"Software\\\\Valve\\\\Steam\", \"display_value\": \"Software\\\\Valve\\\\Steam\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "b5e470bb-d79b-5427-b5fc-bfc1ece9e8bb", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "file_path: %USERPROFILE%\\AppData\\Roaming\\Telegram Desktop\\tdata", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--59c4674c-1cfc-5ae2-90c4-aeb4f2ca7da1\", \"case_id\": \"redlinestealer\", \"type\": \"file_path\", \"value\": \"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Telegram Desktop\\\\tdata\", \"display_value\": \"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Telegram Desktop\\\\tdata\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\", \"ev-a9772bfb027e1304\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "cdba1f79-faf8-5dbc-999c-1d7252982aea", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "file_path: %appdata%\\discord\\Local Storage\\leveldb", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--79feca24-a621-57de-835b-683e5d8974db\", \"case_id\": \"redlinestealer\", \"type\": \"file_path\", \"value\": \"%appdata%\\\\discord\\\\Local Storage\\\\leveldb\", \"display_value\": \"%appdata%\\\\discord\\\\Local Storage\\\\leveldb\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "66063081-d765-59ac-b938-e606e92aa92e", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "file_path: %appdata%\\FileZilla\\recentservers.xml", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--4ed953f7-80aa-5c3a-a8fa-b04ced88ee17\", \"case_id\": \"redlinestealer\", \"type\": \"file_path\", \"value\": \"%appdata%\\\\FileZilla\\\\recentservers.xml\", \"display_value\": \"%appdata%\\\\FileZilla\\\\recentservers.xml\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "4f866223-7845-5b11-9af2-b57f9dfad653", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"redlinestealer\"" } ], "type": "text", "value": "process_name: Implosions.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"redlinestealer\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--4a6fd162-a62b-579f-a3c3-48b940e1d46b\", \"case_id\": \"redlinestealer\", \"type\": \"process_name\", \"value\": \"Implosions.exe\", \"display_value\": \"Implosions.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-9aa682b580c2c0e0\", \"ev-213a0e92794c396e\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "86d4ba54-27be-5d0d-b8fc-42c9217b6f03", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "domain: webhook.site", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"legitimate_shared_service\"], \"observations\": [{\"id\": \"observable--108bc78c-397f-56fc-b432-f54a1f29c10b\", \"case_id\": \"hookedge\", \"type\": \"domain\", \"value\": \"webhook.site\", \"display_value\": \"webhook[.]site\", \"assessment\": \"legitimate_shared_service\", \"interpretation\": \"Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-a02ad2820e607fce\", \"ev-380d1f8d1c7621a1\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "c84954a5-a29d-5909-894d-812cd5c73478", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "file_path: %userprofile%\\Downloads\\*.9ae", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--82f9e644-30f2-5eb0-b1f1-b376f76e27aa\", \"case_id\": \"hookedge\", \"type\": \"file_path\", \"value\": \"%userprofile%\\\\Downloads\\\\*.9ae\", \"display_value\": \"%userprofile%\\\\Downloads\\\\*.9ae\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-380d1f8d1c7621a1\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "9b6210ce-2586-568a-aced-25bd2173795c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "file_path: %userprofile%\\%random%%random%%random%.9ae.cmd", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--88f641af-f897-5e66-a988-11eede04b438\", \"case_id\": \"hookedge\", \"type\": \"file_path\", \"value\": \"%userprofile%\\\\%random%%random%%random%.9ae.cmd\", \"display_value\": \"%userprofile%\\\\%random%%random%%random%.9ae.cmd\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "3ba36a0e-e342-50c7-8111-b4da594aa8da", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "file_path: %userprofile%\\82911ae6-ea27-4996-a664-2322e89da9ae.htm", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--244aedcc-18a3-5fb0-be05-5ec66c0d1e66\", \"case_id\": \"hookedge\", \"type\": \"file_path\", \"value\": \"%userprofile%\\\\82911ae6-ea27-4996-a664-2322e89da9ae.htm\", \"display_value\": \"%userprofile%\\\\82911ae6-ea27-4996-a664-2322e89da9ae.htm\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-380d1f8d1c7621a1\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "52ba072e-df27-5011-82eb-37e5939cca25", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "file_path: %userprofile%\\82911ae6-ea27-4996-a664-2322e89da9ae.xhtml", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--d479f63a-0fbe-50ec-b8ae-290aee4854ae\", \"case_id\": \"hookedge\", \"type\": \"file_path\", \"value\": \"%userprofile%\\\\82911ae6-ea27-4996-a664-2322e89da9ae.xhtml\", \"display_value\": \"%userprofile%\\\\82911ae6-ea27-4996-a664-2322e89da9ae.xhtml\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-380d1f8d1c7621a1\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "22b85aad-9e87-5cf8-a204-810d455146c8", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "process_name: msedge.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"context_only\"], \"observations\": [{\"id\": \"observable--e1bf8303-0db4-5a1e-9010-553364dd3793\", \"case_id\": \"hookedge\", \"type\": \"process_name\", \"value\": \"msedge.exe\", \"display_value\": \"msedge.exe\", \"assessment\": \"context_only\", \"interpretation\": \"Context artifact; correlate with specimen and host evidence.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-380d1f8d1c7621a1\"], \"source\": \"Retained Caronte report; analysis-summaries.json\", \"port\": null}]}" }, { "uuid": "93cb304f-08e9-52ff-a7d0-23073efff542", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: %PROGRAMDATA%\\audiolib\\audiolib", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--9b485c60-98fc-57bd-8b3f-b40194d760aa\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"%PROGRAMDATA%\\\\audiolib\\\\audiolib\", \"display_value\": \"%PROGRAMDATA%\\\\audiolib\\\\audiolib\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Statically recovered artifact; correlate with the specimen and host events.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Local static VBA extraction\", \"port\": null}]}" }, { "uuid": "890cac04-0368-5d87-ab1f-135cdb20de60", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "sha256: 7520dd2043f62335a65211debfc991658f7777f699c65a0497e669bb8ddbd7fd", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"uncharacterised_retrieved_artifact\"], \"observations\": [{\"id\": \"observable--5c919da9-17f7-5b19-8688-8332413d1a9f\", \"case_id\": \"hookedge\", \"type\": \"sha256\", \"value\": \"7520dd2043f62335a65211debfc991658f7777f699c65a0497e669bb8ddbd7fd\", \"display_value\": \"7520dd2043f62335a65211debfc991658f7777f699c65a0497e669bb8ddbd7fd\", \"assessment\": \"uncharacterised_retrieved_artifact\", \"interpretation\": \"Child-file hash reported in the graph; the child content and maliciousness are not independently confirmed. Context only.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Recorded Caronte Astra Graph review, 8 November 2026\", \"port\": null}]}" }, { "uuid": "e850bc66-fc30-5005-8c4f-182c81d88cbd", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"hookedge\"" } ], "type": "text", "value": "scheduled_task_interval: PT61M", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"hookedge\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--59f55649-f42d-52b4-9c7b-16877688452d\", \"case_id\": \"hookedge\", \"type\": \"scheduled_task_interval\", \"value\": \"PT61M\", \"display_value\": \"PT61M\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"The macro defines a 61-minute task interval. This is specimen-specific, rather than a requirement for detecting the family.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Local static macro extraction\", \"port\": null}]}" }, { "uuid": "b76da387-4df3-5b24-83a9-401aea83af25", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "url: https://api.telegram.org/bot%s/sendDocument", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"legitimate_service_url_template\"], \"observations\": [{\"id\": \"observable--859af954-a50c-57d6-a97e-18cb13d6a19b\", \"case_id\": \"gorbag\", \"type\": \"url\", \"value\": \"https://api.telegram.org/bot%s/sendDocument\", \"display_value\": \"hxxps://api[.]telegram[.]org/bot%s/sendDocument\", \"assessment\": \"legitimate_service_url_template\", \"interpretation\": \"Telegram Bot API URL template. The bot-token placeholder is unresolved in this value; retain as service context, not an operational endpoint indicator.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": 443, \"reported_evidence\": \"String at 0x1400B4978, constructed URL in FUN_1400026c0 at 0x140002741, curl_easy_setopt calls at 0x1400026c0\"}]}" }, { "uuid": "d2c29ab5-baf0-5dc5-a499-0cf9c8b0f2cf", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: GY8RPV3HOMKGNSWMFLHP", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--8352922c-bbd5-5660-9036-daaaefa93fd0\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"GY8RPV3HOMKGNSWMFLHP\", \"display_value\": \"GY8RPV3HOMKGNSWMFLHP\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "d4e0188a-d5d1-5530-bc50-2ec3d5513c8e", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: 4543geqsccegrth", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--c29130e5-4c3f-5ca2-ab52-5c015c2842c2\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"4543geqsccegrth\", \"display_value\": \"4543geqsccegrth\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "d6075c81-cfe8-5813-8625-775e2e26b557", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: HYHEBWVUFVWEFYUWEUBCYVBWEVFEGWYTFVT3434", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--c95efbdb-7d6e-565d-82d0-79a763703c17\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"HYHEBWVUFVWEFYUWEUBCYVBWEVFEGWYTFVT3434\", \"display_value\": \"HYHEBWVUFVWEFYUWEUBCYVBWEVFEGWYTFVT3434\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "9cf230a3-72df-583a-97ea-60ee9ef5e1ff", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: AUN07ZRXZMH703Y", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--db778aaf-7560-57a9-95c9-ab4e01598e37\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"AUN07ZRXZMH703Y\", \"display_value\": \"AUN07ZRXZMH703Y\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "f0a45b5b-7b4d-5285-810c-61b898e440af", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: EFEVCD38GRS", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--137b106f-89a8-51d3-9f7d-78973e7227e1\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"EFEVCD38GRS\", \"display_value\": \"EFEVCD38GRS\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "66880556-2bca-5c8f-b653-3c8e4d648539", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: O6RSIWYCF74T4FY", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--afcd11a9-d7cd-5402-a9d9-a0dcb747d924\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"O6RSIWYCF74T4FY\", \"display_value\": \"O6RSIWYCF74T4FY\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "e15d5b37-a5db-534b-ba79-ce55008f6361", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Google\\Chrome\\User Data\\Default\\Network\\Cookies", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--2455dffb-9ac8-5b3c-bba2-428e027b0e39\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Google\\\\Chrome\\\\User Data\\\\Default\\\\Network\\\\Cookies\", \"display_value\": \"Google\\\\Chrome\\\\User Data\\\\Default\\\\Network\\\\Cookies\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "960dee4c-0902-548c-b555-3c83e93ab08e", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Google\\Chrome\\User Data\\Default\\Login Data", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--d62e3b4d-ee78-5755-8937-43aba2c0df02\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Google\\\\Chrome\\\\User Data\\\\Default\\\\Login Data\", \"display_value\": \"Google\\\\Chrome\\\\User Data\\\\Default\\\\Login Data\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "1bf73206-a24f-5dd8-9bba-dd8df3b11fdc", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Microsoft\\Edge\\User Data\\Default\\Network\\Cookies", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--8db0d825-8cfb-5c19-9538-4fcb958ea32f\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Microsoft\\\\Edge\\\\User Data\\\\Default\\\\Network\\\\Cookies\", \"display_value\": \"Microsoft\\\\Edge\\\\User Data\\\\Default\\\\Network\\\\Cookies\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "3f44109e-c609-5a21-a8be-95ba9ce7ba10", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Microsoft\\Edge\\User Data\\Default\\Login Data", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--6e49f8df-4cce-53c5-af28-dc20e4537299\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Microsoft\\\\Edge\\\\User Data\\\\Default\\\\Login Data\", \"display_value\": \"Microsoft\\\\Edge\\\\User Data\\\\Default\\\\Login Data\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "c3a55751-108f-5934-80fd-913cebfed7ba", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Mozilla\\Firefox\\Profiles", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--23544d93-1eff-5f29-9c02-ff24766198dd\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Mozilla\\\\Firefox\\\\Profiles\", \"display_value\": \"Mozilla\\\\Firefox\\\\Profiles\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "d2057b37-3ace-5361-ab63-002673722da3", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Microsoft\\Edge\\User Data\\Local State", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--926e9254-4e65-59a5-bc58-9ce004d3a79b\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Microsoft\\\\Edge\\\\User Data\\\\Local State\", \"display_value\": \"Microsoft\\\\Edge\\\\User Data\\\\Local State\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "30eecee2-28dc-5d9f-8538-28bc5a0674e0", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: Google\\Chrome\\User Data\\Local State", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--d583d02d-ce71-598a-9a0f-0e3363ac574f\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"Google\\\\Chrome\\\\User Data\\\\Local State\", \"display_value\": \"Google\\\\Chrome\\\\User Data\\\\Local State\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "fcbdfd2f-a31b-51cd-b726-2ced7f7e39c6", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "file_path: OpenVPN\\config", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--5487a4e7-e3f6-5536-8beb-048f22ff0d96\", \"case_id\": \"gorbag\", \"type\": \"file_path\", \"value\": \"OpenVPN\\\\config\", \"display_value\": \"OpenVPN\\\\config\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "40865494-c868-518b-b973-a126af0b00a6", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gorbag\"" } ], "type": "text", "value": "other: release", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gorbag\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--ecfb8b19-9b8e-5c04-8541-9a3d73ff56bc\", \"case_id\": \"gorbag\", \"type\": \"other\", \"value\": \"release\", \"display_value\": \"release\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gorbag-derived-payload\", \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\", \"specimen_sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\", \"port\": null}]}" }, { "uuid": "b9ed716f-563e-5f48-b6b4-10ca03e6c2de", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "ip: 127.0.0.1:9100", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"loopback_default\"], \"observations\": [{\"id\": \"observable--f81f0724-4a5a-5907-be79-b5644390a082\", \"case_id\": \"cornflake\", \"type\": \"ip\", \"value\": \"127.0.0.1:9100\", \"display_value\": \"127[.]0[.]0[.]1:9100\", \"assessment\": \"loopback_default\", \"interpretation\": \"Localhost default in serverList. This identifies local configuration, not an external command server.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "9e8feadf-3d6b-5fec-9439-7a0ad9d6e711", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "ip: localhost:9000", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"loopback_default\"], \"observations\": [{\"id\": \"observable--7bcb754e-86f1-51bc-8f91-4dc5c88bf27a\", \"case_id\": \"cornflake\", \"type\": \"ip\", \"value\": \"localhost:9000\", \"display_value\": \"localhost:9000\", \"assessment\": \"loopback_default\", \"interpretation\": \"Localhost default in serverList. This identifies local configuration, not an external command server.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "08b210fb-a36c-549d-ad69-6e80b0ef1888", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "process_name: svchost32.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--2f2697b8-a88a-59bc-86ee-89ec16e59a55\", \"case_id\": \"cornflake\", \"type\": \"process_name\", \"value\": \"svchost32.exe\", \"display_value\": \"svchost32.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "30bcf439-8c84-51bd-b3a8-14b6f8753736", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "process_name: powershell.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--f7e94eb2-5140-59ba-aa9f-4eb38fc5ae6a\", \"case_id\": \"cornflake\", \"type\": \"process_name\", \"value\": \"powershell.exe\", \"display_value\": \"powershell.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "96153697-2bc2-5f21-875f-8b048a38d1e3", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "process_name: cmd.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--f8d0cd4c-2048-5bf8-a2e6-ef60054f8aad\", \"case_id\": \"cornflake\", \"type\": \"process_name\", \"value\": \"cmd.exe\", \"display_value\": \"cmd.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "85d8f8f8-1694-5bea-bc31-cdaa2faf627f", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: cookies.sqlite", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--219a87cf-c5c9-59e6-a670-fbb9083afab2\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \"cookies.sqlite\", \"display_value\": \"cookies.sqlite\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "36ba45a9-2854-52e3-ab56-4858bd9e55f4", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: key4.db", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--92cd9e95-2b6b-58d0-9d45-25ab6017a0f7\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \"key4.db\", \"display_value\": \"key4.db\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "763cc279-eb5a-5200-8232-cc95a5e13625", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: profiles.ini", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--a3027128-26ba-58e8-a056-563de06cfc3a\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \"profiles.ini\", \"display_value\": \"profiles.ini\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "d0702809-32b4-51d2-a3cf-578bd29a8b7e", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: _manifest.json", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--f704329b-34b0-5d96-ad31-3dab6584ab4b\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \"_manifest.json\", \"display_value\": \"_manifest.json\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "fb423558-de0e-54d7-b5b9-bf1f6376386b", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: .ssh\\id_rsa", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--66887eaf-ec61-5b67-b30d-13940bfcd98a\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \".ssh\\\\id_rsa\", \"display_value\": \".ssh\\\\id_rsa\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "b7d46084-0568-5dc6-ae71-682c44fc0a2c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: .ssh\\id_dsa", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--6b1df308-fcd5-5e32-a096-f1acb57e46ad\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \".ssh\\\\id_dsa\", \"display_value\": \".ssh\\\\id_dsa\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "8d0a5a35-c2b8-5cca-9a9b-9ab3c33194b5", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "file_path: .ssh\\id_ed25519", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--695760dd-f024-5cc2-9ad8-7e8b4bf66da7\", \"case_id\": \"cornflake\", \"type\": \"file_path\", \"value\": \".ssh\\\\id_ed25519\", \"display_value\": \".ssh\\\\id_ed25519\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "bc67a59b-80ec-5ae1-8690-d4148de626b3", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "registry_key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--ed7b9967-e0b4-5084-a91d-382ea7623afa\", \"case_id\": \"cornflake\", \"type\": \"registry_key\", \"value\": \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\", \"display_value\": \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "ac8b54b4-bff3-5fd5-b271-2a4dd0e12b59", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "mutex: Single-instance mutex (runtime-generated name)", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"behavior_description\"], \"observations\": [{\"id\": \"observable--bb4e9c01-6049-5c90-a32c-f86ae918449a\", \"case_id\": \"cornflake\", \"type\": \"mutex\", \"value\": \"Single-instance mutex (runtime-generated name)\", \"display_value\": \"Single-instance mutex (runtime-generated name)\", \"assessment\": \"behavior_description\", \"interpretation\": \"Description of runtime mutex generation; no fixed mutex name is supplied.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "8de3e681-1c76-5aef-aa32-0489ad6bb507", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "service: Cloud Sync Service", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--af641c95-c4cc-5ff6-947b-6c5e68253220\", \"case_id\": \"cornflake\", \"type\": \"service\", \"value\": \"Cloud Sync Service\", \"display_value\": \"Cloud Sync Service\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "e22480c1-94e6-538e-981c-4ef30bb03d83", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "scheduled_task: Windows Update Setup (masqueraded name)", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--d82eb332-dcec-58a1-a10d-c5a26a708511\", \"case_id\": \"cornflake\", \"type\": \"scheduled_task\", \"value\": \"Windows Update Setup (masqueraded name)\", \"display_value\": \"Windows Update Setup (masqueraded name)\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "dd5e5630-6159-50bf-a86f-a5078d808c8c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "other: amsi.dll", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--10e698ca-bd7b-5994-8291-44d4daaac971\", \"case_id\": \"cornflake\", \"type\": \"other\", \"value\": \"amsi.dll\", \"display_value\": \"amsi.dll\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "01834877-b2fd-5f9c-b187-08cd4646efd2", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"cornflake\"" } ], "type": "text", "value": "other: AmsiScanBuffer", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"cornflake\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--18d11f8c-d359-53db-badb-c1a9997f746d\", \"case_id\": \"cornflake\", \"type\": \"other\", \"value\": \"AmsiScanBuffer\", \"display_value\": \"AmsiScanBuffer\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"cornflake\", \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\", \"specimen_sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\", \"port\": null}]}" }, { "uuid": "af39c749-bdd3-5403-8f92-6cf42e7a6af3", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "text", "value": "user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"lockbit\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--e770e93f-d51a-5de1-a77e-965aa1dfd556\", \"case_id\": \"lockbit\", \"type\": \"user_agent\", \"value\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\", \"display_value\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-78c130645c95833f\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"lockbit\", \"report_source_sha256\": \"3d472ac0bac03e44acfa0b205035f1c14ba9449a64c81f429e221e37c025c334\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"port\": null}]}" }, { "uuid": "31963e22-ea25-521e-bf59-086fea6721cf", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "text", "value": "process_name: WMIC.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"lockbit\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--22237416-2e8d-5f67-a58d-590253e3f5a1\", \"case_id\": \"lockbit\", \"type\": \"process_name\", \"value\": \"WMIC.exe\", \"display_value\": \"WMIC.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-4270245a5548f107\", \"ev-56504189f47e184a\", \"ev-6de644c97d36e076\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"lockbit\", \"report_source_sha256\": \"3d472ac0bac03e44acfa0b205035f1c14ba9449a64c81f429e221e37c025c334\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"port\": null}]}" }, { "uuid": "91460753-ac5f-5b6c-9d93-cb67c1792e03", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "text", "value": "file_path: C:\\Windows\\System32\\wbem\\WMIC.exe", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"lockbit\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--561b49b4-37ac-5a76-90ce-cf87eebeaebd\", \"case_id\": \"lockbit\", \"type\": \"file_path\", \"value\": \"C:\\\\Windows\\\\System32\\\\wbem\\\\WMIC.exe\", \"display_value\": \"C:\\\\Windows\\\\System32\\\\wbem\\\\WMIC.exe\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-4270245a5548f107\", \"ev-6de644c97d36e076\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"lockbit\", \"report_source_sha256\": \"3d472ac0bac03e44acfa0b205035f1c14ba9449a64c81f429e221e37c025c334\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"port\": null}]}" }, { "uuid": "547e4ec5-22e4-5da6-8c52-2c95a2c1c929", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"lockbit\"" } ], "type": "text", "value": "other: Microsoft Enhanced RSA and AES Cryptographic Provider", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"lockbit\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--c2428c0f-9e38-576f-b914-bff16e5ed7aa\", \"case_id\": \"lockbit\", \"type\": \"other\", \"value\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\", \"display_value\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-4270245a5548f107\", \"ev-56504189f47e184a\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"lockbit\", \"report_source_sha256\": \"3d472ac0bac03e44acfa0b205035f1c14ba9449a64c81f429e221e37c025c334\", \"specimen_sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\", \"port\": null}]}" }, { "uuid": "2c50b92c-573a-5192-a315-97251d96f6e8", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"vidar\"" } ], "type": "text", "value": "other: QuantumPointCollective", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"vidar\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--26e22498-4949-5c28-b139-7efdb6d846e9\", \"case_id\": \"vidar\", \"type\": \"other\", \"value\": \"QuantumPointCollective\", \"display_value\": \"QuantumPointCollective\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-58379f34f0977228\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"vidar\", \"report_source_sha256\": \"ff61c0d0bfc60cc2d24e04ea5019acb90a75a36ed46b4731d28473d8bdb464d3\", \"specimen_sha256\": \"d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\", \"port\": null}]}" }, { "uuid": "80d6dd72-65d7-50c9-8dc3-0d8c29caefeb", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"vidar\"" } ], "type": "text", "value": "other: {{.canton}}:{{.field}}:{{.fly}}", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"vidar\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--0b9db3c5-b5a0-5c60-a61f-fe95c47f8848\", \"case_id\": \"vidar\", \"type\": \"other\", \"value\": \"{{.canton}}:{{.field}}:{{.fly}}\", \"display_value\": \"{{.canton}}:{{.field}}:{{.fly}}\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-1f67167fa8b68ed5\", \"ev-e65e9438d4d52125\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"vidar\", \"report_source_sha256\": \"ff61c0d0bfc60cc2d24e04ea5019acb90a75a36ed46b4731d28473d8bdb464d3\", \"specimen_sha256\": \"d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\", \"port\": null}]}" }, { "uuid": "bcb54500-6a09-55dd-9ba1-694f5afa34c0", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "text", "value": "other: go1.21.1 / GOARCH=amd64 / GOOS=windows / -trimpath=true / CGO_ENABLED=0", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"stealc\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--c003e96d-ba31-5c2a-be78-9a93bdab35f6\", \"case_id\": \"stealc\", \"type\": \"other\", \"value\": \"go1.21.1 / GOARCH=amd64 / GOOS=windows / -trimpath=true / CGO_ENABLED=0\", \"display_value\": \"go1.21.1 / GOARCH=amd64 / GOOS=windows / -trimpath=true / CGO_ENABLED=0\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-b86f6431ccd487fd\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"stealc\", \"report_source_sha256\": \"4d3c7c5b5883729d58b46ca3f87fb876c7d1dde914f1ed42a4950fc8e81eee6d\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"port\": null}]}" }, { "uuid": "bf563845-d487-59d3-aae7-17d6f9bae09e", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "text", "value": "registry_key: SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"stealc\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--8ad19811-5507-5069-be16-d6e6162fce11\", \"case_id\": \"stealc\", \"type\": \"registry_key\", \"value\": \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Time Zones\", \"display_value\": \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Time Zones\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Shared system or application marker; use in combination with specimen-specific behaviour.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-a168531047805fd8\", \"ev-b9732c632df382f4\", \"ev-c19333a746d9b894\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"stealc\", \"report_source_sha256\": \"4d3c7c5b5883729d58b46ca3f87fb876c7d1dde914f1ed42a4950fc8e81eee6d\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"port\": null}]}" }, { "uuid": "1fee4538-3c6c-56aa-88cd-2c51b79587e9", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "text", "value": "other: a9fc80d6897ec1e7b9fe2177fd6f639b33f6d427fe1fe362bc1b92a280918a1e", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"stealc\"], \"assessment\": [\"reported_region_fingerprint\"], \"observations\": [{\"id\": \"observable--625607e7-aead-5414-b973-bcdb105b9a28\", \"case_id\": \"stealc\", \"type\": \"other\", \"value\": \"a9fc80d6897ec1e7b9fe2177fd6f639b33f6d427fe1fe362bc1b92a280918a1e\", \"display_value\": \"a9fc80d6897ec1e7b9fe2177fd6f639b33f6d427fe1fe362bc1b92a280918a1e\", \"assessment\": \"reported_region_fingerprint\", \"interpretation\": \"Fingerprint associated with a reported byte region. It is not the identity hash of an acquired malware file.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2a31a20066533d87\", \"ev-d37b2cac238e2573\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"stealc\", \"report_source_sha256\": \"4d3c7c5b5883729d58b46ca3f87fb876c7d1dde914f1ed42a4950fc8e81eee6d\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"port\": null}]}" }, { "uuid": "d3ce1848-c4b8-5610-a811-3e43ff1b053c", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "text", "value": "other: 5e476c9328bb5f35321b244ba047493e4651dda7fbc8305a8206982701147659", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"stealc\"], \"assessment\": [\"reported_region_fingerprint\"], \"observations\": [{\"id\": \"observable--93a5950c-7935-567d-adc1-4e0cf6c7ec11\", \"case_id\": \"stealc\", \"type\": \"other\", \"value\": \"5e476c9328bb5f35321b244ba047493e4651dda7fbc8305a8206982701147659\", \"display_value\": \"5e476c9328bb5f35321b244ba047493e4651dda7fbc8305a8206982701147659\", \"assessment\": \"reported_region_fingerprint\", \"interpretation\": \"Fingerprint associated with a reported byte region. It is not the identity hash of an acquired malware file.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2a31a20066533d87\", \"ev-d37b2cac238e2573\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"stealc\", \"report_source_sha256\": \"4d3c7c5b5883729d58b46ca3f87fb876c7d1dde914f1ed42a4950fc8e81eee6d\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"port\": null}]}" }, { "uuid": "43b52929-203a-5c4b-af03-6c5416e118b9", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"stealc\"" } ], "type": "text", "value": "other: 53225acd7fd7b6022aae9d235af59c6f60457b9e4952783ac27c958d13c71d4f", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"stealc\"], \"assessment\": [\"reported_region_fingerprint\"], \"observations\": [{\"id\": \"observable--ed446df4-f10f-56a7-b778-e3f71c708607\", \"case_id\": \"stealc\", \"type\": \"other\", \"value\": \"53225acd7fd7b6022aae9d235af59c6f60457b9e4952783ac27c958d13c71d4f\", \"display_value\": \"53225acd7fd7b6022aae9d235af59c6f60457b9e4952783ac27c958d13c71d4f\", \"assessment\": \"reported_region_fingerprint\", \"interpretation\": \"Fingerprint associated with a reported byte region. It is not the identity hash of an acquired malware file.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-2a31a20066533d87\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"stealc\", \"report_source_sha256\": \"4d3c7c5b5883729d58b46ca3f87fb876c7d1dde914f1ed42a4950fc8e81eee6d\", \"specimen_sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\", \"port\": null}]}" }, { "uuid": "9934062f-2af0-5c90-b500-e301e14f1d25", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "text", "value": "other: .data payload blob at file offset 0x6a600, length 294912, entropy 7.999", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"rhadamanthys\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--cef24827-abc0-50ff-a1ab-1344d09305a3\", \"case_id\": \"rhadamanthys\", \"type\": \"other\", \"value\": \".data payload blob at file offset 0x6a600, length 294912, entropy 7.999\", \"display_value\": \".data payload blob at file offset 0x6a600, length 294912, entropy 7.999\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-094ea607219d36cc\", \"ev-1951459b0915bc9c\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"rhadamanthys\", \"report_source_sha256\": \"fe549d202551f74b764fcd69dfdc67504b6507c239398dd38b29aad037ee4166\", \"specimen_sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\", \"port\": null}]}" }, { "uuid": "63be8c6e-d31d-507d-88c1-9bfe880b71f2", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "text", "value": "other: AES forward S-box VA 0x140055d20 / inverse S-box VA 0x140056d30", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"rhadamanthys\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--463e9864-03d7-5072-8638-cc2bb732c56d\", \"case_id\": \"rhadamanthys\", \"type\": \"other\", \"value\": \"AES forward S-box VA 0x140055d20 / inverse S-box VA 0x140056d30\", \"display_value\": \"AES forward S-box VA 0x140055d20 / inverse S-box VA 0x140056d30\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-d563900616c21026\", \"ev-f2cb8fb1c13f71f4\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"rhadamanthys\", \"report_source_sha256\": \"fe549d202551f74b764fcd69dfdc67504b6507c239398dd38b29aad037ee4166\", \"specimen_sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\", \"port\": null}]}" }, { "uuid": "b0ab6708-1200-55fb-94bb-b6856dbb7f63", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"rhadamanthys\"" } ], "type": "text", "value": "other: MBA obfuscation base constant 0xa6e3f6f3215ead45", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"rhadamanthys\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--3b281438-2485-5565-8d99-3dedcd564f92\", \"case_id\": \"rhadamanthys\", \"type\": \"other\", \"value\": \"MBA obfuscation base constant 0xa6e3f6f3215ead45\", \"display_value\": \"MBA obfuscation base constant 0xa6e3f6f3215ead45\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [\"ev-5478bad548d10d39\"], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"rhadamanthys\", \"report_source_sha256\": \"fe549d202551f74b764fcd69dfdc67504b6507c239398dd38b29aad037ee4166\", \"specimen_sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\", \"port\": null}]}" }, { "uuid": "109bc5fa-2c68-5185-9585-781a99b1cf38", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "domain: tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"ransom_note_contact\"], \"observations\": [{\"id\": \"observable--2e50fc98-c62a-55c3-979d-e2b358c18556\", \"case_id\": \"gentlemen\", \"type\": \"domain\", \"value\": \"tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion\", \"display_value\": \"tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad[.]onion\", \"assessment\": \"ransom_note_contact\", \"interpretation\": \"Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "77134ac0-8752-5b94-9288-bd76d87aafcd", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "ip: 193.143.1.142", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"ransom_note_contact\"], \"observations\": [{\"id\": \"observable--2eead336-6a64-577c-883e-4d6e87215c7a\", \"case_id\": \"gentlemen\", \"type\": \"ip\", \"value\": \"193.143.1.142\", \"display_value\": \"193[.]143[.]1[.]142\", \"assessment\": \"ransom_note_contact\", \"interpretation\": \"Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "7f3e8d00-8392-576c-aa66-9099e06d9bfd", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "url: https://smp16.simplex.im/a#yUc3Z5usvD4NpDvvAHmrBk6Wm_4zeYw5RRreY_NHhtc", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"ransom_note_contact\"], \"observations\": [{\"id\": \"observable--6de9ef8b-4da4-5ba3-b3da-8ea2a55dbcd3\", \"case_id\": \"gentlemen\", \"type\": \"url\", \"value\": \"https://smp16.simplex.im/a#yUc3Z5usvD4NpDvvAHmrBk6Wm_4zeYw5RRreY_NHhtc\", \"display_value\": \"hxxps://smp16[.]simplex[.]im/a#yUc3Z5usvD4NpDvvAHmrBk6Wm_4zeYw5RRreY_NHhtc\", \"assessment\": \"ransom_note_contact\", \"interpretation\": \"Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "3658aa5a-0bb3-5f60-9239-fbcd82e65cee", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "url: https://x.com/TheGentlemen26", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"ransom_note_contact\"], \"observations\": [{\"id\": \"observable--ba68c317-cb54-5409-b96f-84970f9924e9\", \"case_id\": \"gentlemen\", \"type\": \"url\", \"value\": \"https://x.com/TheGentlemen26\", \"display_value\": \"hxxps://x[.]com/TheGentlemen26\", \"assessment\": \"ransom_note_contact\", \"interpretation\": \"Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "abb1b547-72c0-5a14-aaf2-54bbe51e7148", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "file_path: README-GENTLEMEN.txt", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--888e1d16-e37f-5d26-91ac-bd586c47974f\", \"case_id\": \"gentlemen\", \"type\": \"file_path\", \"value\": \"README-GENTLEMEN.txt\", \"display_value\": \"README-GENTLEMEN.txt\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "2b880fe9-3f2f-53e1-89fa-a1a95beb17bb", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "file_path: /etc/systemd/system/gautostart.service", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--3141110c-6484-5579-b13e-81c5804f9fff\", \"case_id\": \"gentlemen\", \"type\": \"file_path\", \"value\": \"/etc/systemd/system/gautostart.service\", \"display_value\": \"/etc/systemd/system/gautostart.service\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "f185f5f2-ca47-54bd-9d13-0bcef15291dc", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "service: gautostart.service", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--53d96e19-c958-541c-96d7-7b40b8607eb1\", \"case_id\": \"gentlemen\", \"type\": \"service\", \"value\": \"gautostart.service\", \"display_value\": \"gautostart.service\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "eabc8115-1b7f-5a95-bf2c-c0c75b9b91e9", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "other: C3429265C69E82195A7D3F9F95E05E2168BB87F90FC6C41B8F1D0B68544DDF7769808B2872FB", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"ransom_note_contact\"], \"observations\": [{\"id\": \"observable--9e44a768-fb43-53d6-91e6-a5e9168621f1\", \"case_id\": \"gentlemen\", \"type\": \"other\", \"value\": \"C3429265C69E82195A7D3F9F95E05E2168BB87F90FC6C41B8F1D0B68544DDF7769808B2872FB\", \"display_value\": \"C3429265C69E82195A7D3F9F95E05E2168BB87F90FC6C41B8F1D0B68544DDF7769808B2872FB\", \"assessment\": \"ransom_note_contact\", \"interpretation\": \"Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "155118a9-9cd2-50a2-ae1b-d212643bc991", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "other: RWMmtkZTwQvM8HjjuyvLPQcypSKm88ZpXGxGqhZTrQc=", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--e6e72be8-68ef-5822-bde0-7c4783ab2f77\", \"case_id\": \"gentlemen\", \"type\": \"other\", \"value\": \"RWMmtkZTwQvM8HjjuyvLPQcypSKm88ZpXGxGqhZTrQc=\", \"display_value\": \"RWMmtkZTwQvM8HjjuyvLPQcypSKm88ZpXGxGqhZTrQc=\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "369eb2ce-e15c-5a17-9822-fa9d9d7d5669", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "other: 094803a4bd0ca36af17131ab1beb92a5", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--fb944b7e-e11d-54ad-bb4d-c35b1a29d341\", \"case_id\": \"gentlemen\", \"type\": \"other\", \"value\": \"094803a4bd0ca36af17131ab1beb92a5\", \"display_value\": \"094803a4bd0ca36af17131ab1beb92a5\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "a104bb1e-5e6d-53fc-a7ec-b47125207384", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "other: #g-autostart", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--091d672e-a625-5aa0-9947-36545b021c4c\", \"case_id\": \"gentlemen\", \"type\": \"other\", \"value\": \"#g-autostart\", \"display_value\": \"#g-autostart\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" }, { "uuid": "b28dbe64-3bea-5bdf-917b-76b4241c373a", "Tag": [ { "name": "beelzebub:record=\"context-not-detection\"" }, { "name": "beelzebub:case=\"gentlemen\"" } ], "type": "text", "value": "other: LOCKER_BACKGROUND=1", "category": "Other", "to_ids": false, "distribution": "5", "disable_correlation": true, "comment": "{\"case_ids\": [\"gentlemen\"], \"assessment\": [\"correlation_artifact\"], \"observations\": [{\"id\": \"observable--8a2abcb6-b663-55f2-a5c1-9f339ff44dcb\", \"case_id\": \"gentlemen\", \"type\": \"other\", \"value\": \"LOCKER_BACKGROUND=1\", \"display_value\": \"LOCKER_BACKGROUND=1\", \"assessment\": \"correlation_artifact\", \"interpretation\": \"Reported code or host artifact; correlate with the exact specimen, process and time.\", \"standalone_detection\": false, \"automatic_blocking\": false, \"evidence_ids\": [], \"source\": \"Caronte reverse-engineering response retrieved 9 November 2026\", \"report_id\": \"gentlemen\", \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\", \"specimen_sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\", \"port\": null}]}" } ], "EventReport": [ { "uuid": "50405b10-16da-58c8-9dfc-d73a182c0add", "distribution": "5", "name": "Gorbag / delivery workbook", "content": "An XLSM delivery workbook reconstructs a PE payload that collects browser data, OpenVPN configuration and documents, with Telegram Bot API upload logic.\n\nReverse-engineering findings:\nThe recovered PE collects Chrome and Edge Login Data, Cookies and Local State files, Firefox profile data, and OpenVPN configuration. Its document sweep covers 21 extensions, including Office documents, archives, email files and images.\n\nThe upload routine at `FUN_1400026c0` builds `https://api.telegram.org/bot%s/sendDocument` and uses libcurl multipart form data with `chat_id` and `document` fields. The decoder at `FUN_1400014b0` applies two layers of XOR to configuration, with constants including `GY8RPV3HOMKGNSWMFLHP` and `4543geqsccegrth`.\n\nThe executable also transforms files in place with a derived XOR key, creates a self-deleting batch component, checks for debuggers and resolves APIs through LoadLibraryW and GetProcAddress. The Telegram URL contains a bot-token placeholder, so the feed records it as a service template rather than a unique attacker endpoint.\n\nEvidence scope: Workbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\n\nAnalysis record: workbook_and_recovered_payload_reviewed; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Gorbag / UAC-0226\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\nhttps://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927\",\n \"case_id\": \"gorbag\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927\",\n \"sha1\": \"e27e0d0a4b308f9b6b0469159931eb5e343e7ff8\",\n \"md5\": \"388374f8478203844f854ffe213f7a47\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 3212016,\n \"catalog_filename\": \"додаток податкова.xlsm\",\n \"catalog_file_type\": \"xlsm\",\n \"catalog_first_seen_utc\": \"2026-11-03T10:16:11Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:23.178127+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-3ae434c604059052c9d30e8a779acb4f968632059f1196810d76a8fd960ab7eb-1794166774656270472\",\n \"report_id\": \"gorbag\",\n \"report_source_sha256\": \"493255d57303dd210d84fa279a16304b3eb95d03f9e53b7b8c6d1cca62a8549c\"\n },\n {\n \"id\": \"sha256:df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\",\n \"case_id\": \"gorbag\",\n \"role\": \"derived\",\n \"hashes\": {\n \"sha256\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77\",\n \"sha1\": \"ebcd20d46b40734a03e645779875f1fe87882442\",\n \"md5\": \"4f244724e3ac2aae8d39f72e911a9a22\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 815616,\n \"catalog_filename\": \"df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": null,\n \"parent_sha256\": \"9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927\",\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:26.281192+00:00\",\n \"malwarebazaar_url\": null,\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-28ccbd7e777c2cf89849dca303c342d61bde9db6b88544c991bec3bd7edeb566-1794167689394785735\",\n \"report_id\": \"gorbag-derived-payload\",\n \"report_source_sha256\": \"354cc1a10aa486fd8c7e911a85e3d1e399b71c62d4d10b9ac25464db5ab265b0\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "95bfccb4-8d4b-596d-8bcf-56021a30dc72", "distribution": "5", "name": "HOOKEDGE", "content": "Office delivery document and reconstructed batch client using an off-screen Edge window for task retrieval and a separate webhook path for result submission.\n\nReverse-engineering findings:\nThe recovered macro installs a scheduled task with a 61-minute interval and writes the command-loop components. The reconstructed batch launches Microsoft Edge in a 1×1 window at off-screen coordinates 10000,10000, with an inline base64 HTML document that redirects to the tasking webhook.\n\nAfter a 20-second wait, the script assembles downloaded task material into a command file, executes it with `call`, and captures standard output and error. The original macro supplies separate HTML wrappers and the result-submission webhook. Task retrieval and result submission therefore have distinct URLs and roles.\n\nOutput filenames are generated from `%random%` expressions. The command loop also terminates processes and removes files after preparing the results.\n\nEvidence scope: Match the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: APT28 / BlueDelta; moderate-confidence attribution by Recorded Future\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\nhttps://www.recordedfuture.com/research/bluedelta-targets-with-hookedge\n\nSpecimens:\n[\n {\n \"id\": \"sha256:49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\",\n \"case_id\": \"hookedge\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\",\n \"sha1\": \"512920c5e31d08d65940877bdb29d0a17738ce37\",\n \"md5\": \"39cc6af95d0425f160571032a6719ad3\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 39811,\n \"catalog_filename\": \"0032.doc\",\n \"catalog_file_type\": \"doc\",\n \"catalog_first_seen_utc\": \"2026-10-20T20:10:30Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:23.110720+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-65845193021d98e60be32a700aeeb8e16fd91ba59508a70b756796cdfd91b0a4-1794166889148737325\",\n \"report_id\": \"hookedge\",\n \"report_source_sha256\": \"483c8c36b57dca7c3661e16abe6f8e279727d1145942b9e639c9799b0044ea72\"\n },\n {\n \"id\": \"sha256:2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a\",\n \"case_id\": \"hookedge\",\n \"role\": \"derived\",\n \"hashes\": {\n \"sha256\": \"2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a\",\n \"sha1\": \"f7ce179447d9693adb10341726989b3b016d4360\",\n \"md5\": \"cb040464587c7901926169d8e046fad8\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 1160,\n \"catalog_filename\": \"2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a.bat\",\n \"catalog_file_type\": \"bat\",\n \"catalog_first_seen_utc\": null,\n \"parent_sha256\": \"49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495\",\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:26.551206+00:00\",\n \"malwarebazaar_url\": null,\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-f6d95d852209a96c47f7927c41a7f4d7229b1e3f40b8e29cd7da578569646e02-1794167686725401633\",\n \"report_id\": \"hookedge-derived-batch\",\n \"report_source_sha256\": \"64be7fd319214a97b4e8f6cc5699784257f29faad366e68e836bb32e1faf048e\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "3559199e-1b54-5fae-8b5e-a2bea2021bde", "distribution": "5", "name": "Covenant-tagged proxy loader", "content": "An IDStore.dll proxy loader uses the resolvefree mutex and a HIDE container in icon.png, deriving an AES key with PBKDF2 before calling the recovered stage in memory.\n\nReverse-engineering findings:\nThe DLL resolves the genuine idstore.dll and forwards DllCanUnloadNow and DllGetClassObject. Its activation logic checks the host process, uses the `resolvefree` mutex, and reads `%appdata%\\Microsoft\\Network\\Cache\\icon.png`.\n\nThe container uses the `HIDE` marker and version 1. Caronte traces PBKDF2-HMAC-SHA256 with 20,000 iterations and AES-CBC decryption, followed by PKCS#7 unpadding and allocation of executable memory through a resolved NtAllocateVirtualMemory function. The loader retries on a 15-second cycle.\n\nThe passphrase `838645f4bab7458fb130c7120a500982` is independently verified in this DLL after XOR-0x68 decoding and also appears in PixyNetLoader. The acquired artifact is the proxy loader; icon.png is the separately staged payload container.\n\nEvidence scope: The acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: APT28 / Sednit\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/\nhttps://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86\",\n \"case_id\": \"covenant-grunt\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86\",\n \"sha1\": \"fbfaff2e2ed7ac6608c1a7bb2055941d54c52a92\",\n \"md5\": \"3078d19a4860184eaac43cb45622672f\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 218112,\n \"catalog_filename\": \"default-20241101-1112.dll\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-10-19T09:05:08Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:23.094243+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-c4bfe41d90f3305abdcecdb699303514b9fe6c128296ee8b1d6266820f68fdeb-1794166886171306031\",\n \"report_id\": \"covenant-grunt\",\n \"report_source_sha256\": \"bd461d431fff2b13c449bc4b177237748bdc6eef82cfcd88387844443d9b0c2d\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "5fb2348a-7793-53ef-b17e-ae182f116aea", "distribution": "5", "name": "Matchboil", "content": "A protected .NET loader resolves native APIs dynamically, handles encrypted resources and invokes assemblies in memory through a flattened managed-code control flow.\n\nReverse-engineering findings:\nCaronte reconstructs string-split resolution of VirtualAlloc, VirtualProtect, WriteProcessMemory, OpenProcess and CloseHandle, binding the resolved functions to delegates with Marshal.GetDelegateForFunctionPointer.\n\nThe loader handles four encrypted resources, hooks AppDomain.ResourceResolve and combines Rijndael/AES, TripleDES, MD5 and decompression routines with Assembly.Load, Activator.CreateInstance and assembly-entry-point invocation. The largest resource is 215,580 bytes.\n\nCaronte recovers an AES-256 key/IV pair for one routine, native trampolines and RSA/MD5 anti-tamper material. The embedded stage derives its own configuration at runtime.\n\nEvidence scope: The reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: UAC-0099; assessed as Russia-aligned by ESET\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/\nhttps://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11\",\n \"case_id\": \"matchboil\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11\",\n \"sha1\": \"f01698a5e796c1f541e82bf4ff6823f3f72f58a9\",\n \"md5\": \"eb0da1bf4db13bbb8bc8fbf752274746\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 572416,\n \"catalog_filename\": \"file\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-10-09T07:58:48Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:23.093629+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-40dceb2cc276c8ce87a2212bfb9e183260f15d1fde4beb386df9ed6c9861e078-1794166889978184281\",\n \"report_id\": \"matchboil\",\n \"report_source_sha256\": \"d99186a043d361b5b9a87441634f89bfa6ea23dc0cb7da2b96067677065ee07c\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "71ccd88a-a1c5-5b0f-b0c9-79376a7d4ffa", "distribution": "5", "name": "Gamaredon / UltraVNC package", "content": "A weaponized 7-Zip SFX package deploys a renamed UltraVNC server and configures an outbound reverse-VNC connection to seemsurprise.com:443.\n\nReverse-engineering findings:\nThe SFX configuration selects silent extraction to `%APPDATA%\\Adobe` and hidden-console execution of 68083.cmd. The launcher opens a decoy document, copies the disguised archive member FwYmY8YvYxYMYVYi.ini to explorerr.exe, then starts the renamed UltraVNC server.\n\nThe reverse-VNC command uses `-autoreconnect -connect seemsurprise.com:443` and a MAC-address-derived client identifier. UltraVNC.ini specifies a local listening port of 5612; the package includes an RC4 DSM plugin and key file.\n\nThe launcher also cleans up the staging directory. A password configuration is bundled with the remote-access files.\n\nEvidence scope: UltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Gamaredon / FSB\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/\nhttps://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73\",\n \"case_id\": \"gamaredon\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73\",\n \"sha1\": \"4a1aa20a1d998235e1dab81f124ce6c6d79656a2\",\n \"md5\": \"9a30c5d73737a637058fcf8468541a2f\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 1305670,\n \"catalog_filename\": \"7ZSfxMod_x86.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-10-02T21:26:53Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:24.066991+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-8025773ef1b5240a3915c779318f3a3b8e8efea814392a21bdec3a3568a0aa72-1794166908097894271\",\n \"report_id\": \"gamaredon\",\n \"report_source_sha256\": \"794215b8693d0ba6fc0e99c7964cc55478be6e53f7a42aff1c7eebd41b7862ab\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "5399b288-d104-5ea7-98c4-d1d664b4a635", "distribution": "5", "name": "CornFlake catalog specimen", "content": "The CornFlake catalog specimen is described by Caronte as a Go RemusStealer-style infostealer/RAT, with browser and SSH collection, surveillance features and a configurable WebSocket channel.\n\nReverse-engineering findings:\nThe CornFlake name follows the catalog and Microsoft hash match. Caronte classifies the code as a RemusStealer-style Go infostealer/RAT. Collection routines target Chromium and Firefox browsers, SSH keys, RDP server lists, Office recent-file data and USB history.\n\nThe report traces screenshot, webcam and microphone capture, keystroke and clipboard monitoring, document watching and USB-file collection. Persistence paths include registry Run keys, a scheduled task presented as Windows Update Setup and a service presented as Cloud Sync Service, with svchost32.exe as a process name.\n\nThe connection chain runs from `connectLoop` at 0x140311160 through `serverList` and `tryDNSFallback`. Defaults are localhost:9000 and 127.0.0.1:9100. DNS TXT lookup parses `s=` host/port records from a domain supplied at runtime. The feed records these loopback defaults and the lookup mechanism as context; they do not supply an external command-server address.\n\nEvidence scope: CornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Storm-2945, subcluster Midnight Blizzard / SVR\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/\nhttps://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\",\n \"case_id\": \"cornflake\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593\",\n \"sha1\": \"510af9bb00ff5d4a6856b1291af55db9f6e13551\",\n \"md5\": \"fba867df17721879df9d8dcca68d6900\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 8113978,\n \"catalog_filename\": \"123.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-08-01T05:53:40Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:23.971700+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-907aef472f5e5b1c87eddc6d410cac5df5b29e616772a70f2fb539f4ef86dfe1-1794166925444932116\",\n \"report_id\": \"cornflake\",\n \"report_source_sha256\": \"7de898577e5e61d01bc9af60179314683d1a23c77e4d2c6dbab826fbb0455e4c\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "287a519d-6e25-54f6-b888-8a0abee56627", "distribution": "5", "name": "ChocoShell", "content": "A PowerShell infostealer collects browser credentials and cookies, Microsoft token-cache data and WiFi credentials, with a configured HTTPS upload workflow.\n\nReverse-engineering findings:\nThe script includes an AMSI reflection bypass, a WinHTTP COM wrapper, a timing check and elevation paths involving SilentCleanup, wsreset.exe and sdclt.exe. Its elevated stub retrieves a second-stage resource from the configured HTTPS server.\n\nCollection includes Chromium-family App-Bound Encryption key handling, DPAPI and NCrypt/AES-GCM operations, VSS-assisted database copies, Chrome DevTools Protocol cookie access, Firefox-family cookie stores, Microsoft Token Broker .tbres files and netsh-based WiFi credential collection.\n\nThe upload path gzip-compresses and base64-encodes the results, then submits JSON to `/t/event`. The feed preserves the configured server, beacon, download and upload paths as distinct indicators and includes their documented query-matching rules.\n\nEvidence scope: The indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Storm-2945, subcluster Midnight Blizzard / SVR\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\nhttps://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\",\n \"case_id\": \"chocoshell\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c\",\n \"sha1\": \"937e75e0e1c82eecab69e9b8ad481bd7e0845308\",\n \"md5\": \"c6f4df18cb880500f3921a179c3a3766\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 55877,\n \"catalog_filename\": \"123.ps1\",\n \"catalog_file_type\": \"ps1\",\n \"catalog_first_seen_utc\": \"2026-08-01T05:56:27Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:23.993002+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-118ed4d916189d577a88ee671c3429f1c49171202be84f85ef9e7081c71467a5-1794166913024228063\",\n \"report_id\": \"chocoshell\",\n \"report_source_sha256\": \"91671059e6d50b9655a9d1a246774a477a8a33ef1eb1841030186726f2c66301\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "6e1cec44-35e4-54e2-83c8-3e3e9308bd7a", "distribution": "5", "name": "Prime ReverseShell", "content": "A PS2EXE-style .NET host loads nnnnrth.ps1, waits about eight minutes and opens a TCP reverse shell to 89.44.9.186:3240.\n\nReverse-engineering findings:\nThe managed entry point reads the manifest resource nnnnrth.ps1 and feeds it into a PowerShell runspace. The script delays execution with a Get-Date/Start-Sleep loop before reconstructing the destination from `89n44n9n186_3240`.\n\nA System.Net.Sockets.TcpClient connects to 89.44.9.186 on port 3240. A StreamReader loop passes received lines to Invoke-Expression and writes output plus the working directory back with HTTP-like status and JSON framing.\n\nThe literal `Host: ipinfo.io` is part of that framing. Other embedded addresses have different, unused roles in the traced connection path. The feed keeps the configured destination separate from those contextual values.\n\nEvidence scope: Use the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Gorbag\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/\nhttps://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8\",\n \"case_id\": \"prime-reverseshell\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8\",\n \"sha1\": \"a5e0a82bf6cc302a20d917235643b748f73fcc27\",\n \"md5\": \"0a178f76c48c038e8bad03a62b52cfc9\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 43008,\n \"catalog_filename\": \"wintel\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2025-04-08T07:16:55Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:24.059509+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-0b3e34d2ccb101676fdc8bfa43492029f7598e7e823e71181e44a19498981ade-1794166916942557771\",\n \"report_id\": \"prime-reverseshell\",\n \"report_source_sha256\": \"4cd5b33b160ad9b7075a42a09fca346f53a6fe1855f17f35f3a33d7923740c00\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "fec5d8cc-86f2-5f61-8dab-00ae47792406", "distribution": "5", "name": "PixyNetLoader", "content": "An EdgeSyncPr.dll proxy loader extracts an encrypted stage from EdgeLogo.png and shares a verified passphrase with the Covenant-tagged DLL.\n\nReverse-engineering findings:\nThe DLL presents itself as EdgeSyncPr.dll, resolves stobject.dll and forwards COM exports. It decodes XOR-0x57 strings, checks regsvr32.exe or explorer.exe as its host, and applies a Sleep-based timing check before the staged execution path.\n\nThe loader reads `%programdata%\\Microsoft\\DeviceSync\\EdgeSync\\EdgeLogo.png`, extracts image bits, derives a key with PBKDF2-HMAC-SHA256 at 20,000 iterations, and applies AES-CBC. The recovered container is checked for `HIDE` and CRC32-related consistency before executable-memory allocation and invocation. The cycle includes a 20-minute sleep.\n\nIts plaintext passphrase matches the independently decoded constant in the Covenant-tagged DLL. API resolution uses an export-table hash walk with seed 0x1E9A and multiplier 0x21. The acquired DLL and its external image container are separate artifacts.\n\nEvidence scope: The technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: APT28\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/\nhttps://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit\n\nSpecimens:\n[\n {\n \"id\": \"sha256:c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5\",\n \"case_id\": \"pixynetloader\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5\",\n \"sha1\": \"e457641615b548c315913fac7e8255519e50687f\",\n \"md5\": \"b077401fe3d9642345d4c3deafa60aa5\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 232960,\n \"catalog_filename\": \"EdgeSyncPr.dll\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-06-05T08:21:49Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:24.866694+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-a936bebb693c6a913ed3c9f9a08d268892f84e3e6b30373649768e1110643f75-1794166921354156365\",\n \"report_id\": \"pixynetloader\",\n \"report_source_sha256\": \"eb9bff88ae07c789ce4b42ad2589c6b5eb052ddc297b6e61d0ac712b1eec9a72\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "0ee452c7-126a-5a8a-9dc3-e5dd0303e342", "distribution": "5", "name": "DynoWiper", "content": "A Windows disk wiper enumerates fixed and removable drives, overwrites file content using a PRNG-generated pattern and performs a subsequent deletion pass.\n\nReverse-engineering findings:\nThe orchestrator seeds a Mersenne Twister using RtlGenRandom, enumerates logical drives and selects fixed and removable volumes. Its directory walk applies an exclusion list that includes Windows and Program Files paths.\n\nFor selected files, it clears attributes and writes a 16-byte buffer at the header and at up to 4,096 PRNG-selected offsets. After five seconds, it recursively deletes files. This overwrite-and-delete sequence implements the wiping behavior.\n\nThe executable contains the build path `C:\\Users\\vagrant\\Documents\\Visual Studio 2013\\Projects\\Source\\Release\\Source.pdb`. Caronte identifies the enumeration and write functions responsible for local file destruction; no command-channel role is assigned.\n\nEvidence scope: The report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Sandworm; moderate-confidence attribution by ESET\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/\nhttps://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160\",\n \"case_id\": \"dynowiper\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160\",\n \"sha1\": \"69ede7e341fd26fa0577692b601d80cb44778d93\",\n \"md5\": \"c4379da51e8b9e86ec3de934f9373f4a\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 167424,\n \"catalog_filename\": \"schtask.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-01-30T11:53:32Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:24.881532+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-c9a61400076e453a82bf9b33b169f46c932e7a3712dd6c6b65476f3ba7958119-1794166928596587210\",\n \"report_id\": \"dynowiper\",\n \"report_source_sha256\": \"a93cb607ac6474d5c08f51830cb9e8af984d51d8add7b068c22577a054ac8c6e\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "7ee6e80f-e830-5c5c-8f54-e64e9e28a034", "distribution": "5", "name": "LummaStealer catalog specimen", "content": "A hash-verified LummaStealer catalog specimen with I386 PE structure and a retained static and reputation graph.\n\nReverse-engineering findings:\nThis entry documents the file identity, PE metadata and imported libraries. SHA-256, SHA-1 and MD5 are available for exact-file searches. Collection routines and network destinations are not assigned from the Lumma catalog label.\n\nEvidence scope: Available coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\n\nAnalysis record: static_identification; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Principal developer based in Russia according to Microsoft\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/\nhttps://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9\",\n \"case_id\": \"lummastealer\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9\",\n \"sha1\": \"1158d28851adc223b7cc93fcc9585381fe53be34\",\n \"md5\": \"3837b2ae95f88ec677f83fa95ac50a79\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 466944,\n \"catalog_filename\": \"3837B2AE95F88EC677F83FA95AC50A79.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-11-04T04:20:11Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"failed\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:25.117176+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-c91d29331e69d0191216c1d5d10dc8d4eaaa8b88bac16130c7647782339f6d03-1794166931545436292\",\n \"report_id\": \"lummastealer\",\n \"report_source_sha256\": \"2a02ca588cdbbaf2c28d7a255dc4fd1bcd759ab914038dd5d2ff57ed61353889\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "82c25448-093b-5765-a94e-0b35e3f32c50", "distribution": "5", "name": "RedLineStealer", "content": "A managed RedLine-style infostealer implements browser and wallet collection, host profiling and a WCF task-processing workflow.\n\nReverse-engineering findings:\nThe report maps EntryPoint configuration fields, EndpointConnection WCF methods and ResultFactory collection actions. Collection routines cover browser credentials, cookies, autofill and payment data, with SQLite parsing and DPAPI/BCrypt AES-GCM operations.\n\nAdditional targets include wallet extensions and wallet folders, Telegram tdata, Discord leveldb, FileZilla and VPN configuration. Host profiling uses WMI and screenshot capture. DownloadAndExecuteUpdate, CommandLineUpdate and OpenUpdate implement operator-task handling.\n\nCaronte lists `194.156.79.165:55615` and its HTTP URL as endpoint candidates, alongside code references and the campaign marker `cheat`. They remain in the feed's context section. Services such as ipinfo.io serve a separate public-IP or geolocation lookup role.\n\nEvidence scope: 194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Criminal ecosystem; developers investigated by the US Department of Justice\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/\nhttps://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers\n\nSpecimens:\n[\n {\n \"id\": \"sha256:1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5\",\n \"case_id\": \"redlinestealer\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5\",\n \"sha1\": \"66d0a00577a6e7415cfb21b4cf88805bedc34889\",\n \"md5\": \"a5c45448100c2a173f73d339bbee9b47\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 97792,\n \"catalog_filename\": \"A5C45448100C2A173F73D339BBEE9B47.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-11-08T10:30:05Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:24.998272+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-74d07ca0664f22559294cf764753d108d5292e3ec56dd95d6a7a1071ce01a333-1794166932724092638\",\n \"report_id\": \"redlinestealer\",\n \"report_source_sha256\": \"066afdd8ff7dfb6ac64b1b8deaa652b21e9789c772c905df595ae2eb6a2431d5\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "38521fff-a916-580d-9712-667b186b2f17", "distribution": "5", "name": "LockBit catalog specimen", "content": "A Windows specimen catalog-labelled LockBit (Caronte family confidence: possible) decodes stack-built strings, resolves APIs by hash, removes shadow copies and gates file encryption on an HTTPS response from docrack.me.\n\nReverse-engineering findings:\nStrings are decoded with per-string modular multiplication, and an API-hash resolver caches function addresses. The code deletes shadow copies through WMIC, uses Restart Manager to unlock files, traverses drives and directories, and implements file encryption. CryptoAPI provider names and ChaCha constants appear in those routines.\n\nThe entry path at `FUN_14001f880` passes the UTF-16 URL `https://docrack.me` into `FUN_14001f480`. Caronte traces WinHttpCrackUrl, WinHttpConnect, a GET request and a status check that allows the subsequent stage to proceed on a 2xx response. The endpoint's documented role is an HTTPS execution gate.\n\nWe found the URL's UTF-16LE bytes at file offset 236048 in the hash-verified sample. No server contact or sample execution was needed for that check. The feed includes the exact URL and hostname/TCP-443 pair.\n\nEvidence scope: The HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Russian developer/administrator charged by the US Department of Justice\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\nhttps://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware\n\nSpecimens:\n[\n {\n \"id\": \"sha256:99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\",\n \"case_id\": \"lockbit\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658\",\n \"sha1\": \"b2b0244b03e80a3e3b355a535411faf3bf4fce74\",\n \"md5\": \"1dff89c029b823fa2a3b488d4a57affb\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 267264,\n \"catalog_filename\": \"ThermoCalc2026a-CrackedBy-DoCrackMe.exe.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-08-19T09:11:13Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:25.512288+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-be848912d4118520a33698e637dd5bf0191fc7c6e97fc673d6299008eec20bd4-1794166936622716589\",\n \"report_id\": \"lockbit\",\n \"report_source_sha256\": \"3d472ac0bac03e44acfa0b205035f1c14ba9449a64c81f429e221e37c025c334\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "63be8301-2f47-5f8b-bf91-bc7ad2f56520", "distribution": "5", "name": "Vidar catalog specimen", "content": "The Vidar catalog specimen is a Go executable with obfuscated application identifiers, indirect API resolution and large unreferenced padding regions.\n\nReverse-engineering findings:\nCaronte maps randomized main-package identifiers and a three-field template `{{.canton}}:{{.field}}:{{.fly}}`, alongside Adler32 and base32 operations. Windows interaction is routed through LoadLibrary, GetProcAddress, SyscallN and LazyProc.Call indirection.\n\nConcrete API literals include VirtualAlloc and GetModuleFileNameW. The analysis separates roughly 540 KB of unreferenced, high-entropy .rdata padding from code-referenced data, using pointer, relocation and RIP-relative reference checks.\n\nThe module name and template are useful markers for comparing this file with other Go artifacts. Vidar remains the catalog label: the findings above do not establish browser theft, a network destination or a later payload.\n\nEvidence scope: Vidar is the catalog context. The reported code findings describe the acquired Go artifact.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Russian-speaking criminal ecosystem\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/\nhttps://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution\n\nSpecimens:\n[\n {\n \"id\": \"sha256:d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\",\n \"case_id\": \"vidar\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2\",\n \"sha1\": \"ccea4b815266482209f16026a128254ddc2a029d\",\n \"md5\": \"39f48fdc2fe7c7bb82cb0c9917201104\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 4780992,\n \"catalog_filename\": \"Dol-stBootV2.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-11-08T15:49:40Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:25.523439+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-64dd451c6aa4e96a7a820ff48dd1156920c53756aacc221ae7bdf53aeaf71f3f-1794166961704940995\",\n \"report_id\": \"vidar\",\n \"report_source_sha256\": \"ff61c0d0bfc60cc2d24e04ea5019acb90a75a36ed46b4731d28473d8bdb464d3\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "b860e678-7687-5c58-8fc0-1fdfee058806", "distribution": "5", "name": "Stealc catalog specimen", "content": "The Stealc catalog specimen is a Go 1.21.1 executable with selectively renamed application symbols and synthetic high-entropy padding.\n\nReverse-engineering findings:\nThe report identifies 37 renamed main-package functions while the surrounding Go runtime and syscall symbols retain their standard names. Build information records trimpath and CGO_ENABLED=0.\n\nThree unreferenced `.rdata` runs total roughly 694 KB. Their byte differences repeat a +25/-3 arithmetic progression with period-256 autocorrelation, supporting their identification as generated filler.\n\nThe feed groups the application module, registry and API markers, Go runtime tables and certificate-validation URLs by their roles. Region fingerprints identify byte ranges within this file, not separately acquired payloads.\n\nEvidence scope: Stealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Also distributed by Russian-speaking criminal groups\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/\nhttps://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\n\nSpecimens:\n[\n {\n \"id\": \"sha256:0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\",\n \"case_id\": \"stealc\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f\",\n \"sha1\": \"bc5b95e545b7911a252328ae98bbbd9ea8270e18\",\n \"md5\": \"bfd9de847fe1fa7e1716cde61c9ac0b0\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 3443648,\n \"catalog_filename\": \"OurNew.exe\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-11-07T15:52:34Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:25.861772+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-d28f51905d514a2f490484f173915472939b47310b3b1f73820d9745bd0481b8-1794166961145350839\",\n \"report_id\": \"stealc\",\n \"report_source_sha256\": \"4d3c7c5b5883729d58b46ca3f87fb876c7d1dde914f1ed42a4950fc8e81eee6d\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "4dd0f005-f85d-5fb2-af76-7ff82a561c8d", "distribution": "5", "name": "Rhadamanthys / two retained specimens", "content": "The smaller Rhadamanthys catalog specimen is an AES-packed x64 loader with a runtime function-pointer table, memory-protection changes and mixed boolean-arithmetic obfuscation.\n\nReverse-engineering findings:\nCaronte identifies a 294,912-byte encrypted .data blob beginning at file offset 0x6a600, preceded by a plaintext offset table. A compiled Rijndael implementation includes forward and inverse AES S-boxes at 0x140055d20 and 0x140056d30.\n\nLoadLibraryA and GetProcAddress populate a writable .fptable section at runtime. VirtualProtect calls at 0x140046390, 0x140046869 and 0x14004689a accompany the table and memory-permission transitions. The code uses CRC32 tables and a repeated arithmetic base constant `0xa6e3f6f3215ead45`.\n\nThe encrypted blob, offset table and runtime API resolution describe the smaller file's packed-loader structure. All addresses and region fingerprints in this report refer to its SHA-256.\n\nEvidence scope: The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\n\nAnalysis record: smaller_specimen_loader_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Also used by Russian-speaking criminal groups\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/\nhttps://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet\n\nSpecimens:\n[\n {\n \"id\": \"sha256:6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\",\n \"case_id\": \"rhadamanthys\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\",\n \"sha1\": \"ef2ea8de20d62f06aae88341da12c1b35dd5cb3d\",\n \"md5\": \"68855abb0d31bd2ff47a95a18ec255c3\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 766976,\n \"catalog_filename\": \"6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-08-10T14:44:46Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:26.028071+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-d450e15637b6c04ba32543a7494766018169560b4d8790f0b6c5703d0ebb0c3f-1794167522906930562\",\n \"report_id\": \"rhadamanthys\",\n \"report_source_sha256\": \"fe549d202551f74b764fcd69dfdc67504b6507c239398dd38b29aad037ee4166\"\n },\n {\n \"id\": \"sha256:7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad\",\n \"case_id\": \"rhadamanthys\",\n \"role\": \"alternative\",\n \"hashes\": {\n \"sha256\": \"7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad\",\n \"sha1\": \"87596edc57173f151068404152eb50212c768c96\",\n \"md5\": \"73c940e6cb2ff49f8e8c145524c41fd8\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 32276994,\n \"catalog_filename\": \"7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad\",\n \"catalog_file_type\": \"exe\",\n \"catalog_first_seen_utc\": \"2026-09-29T10:57:14Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"submit_failed\",\n \"reverse_engineering_status_at_snapshot\": null,\n \"analysis_snapshot_utc\": \"2026-11-08T20:23:40.301994+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/\",\n \"live_execution_observed_by_us\": false\n }\n]", "timestamp": "1794239233" }, { "uuid": "0a2406fd-b2b0-5a66-b175-4f60f2be09aa", "distribution": "5", "name": "The Gentlemen", "content": "A Go Linux ransomware executable combines operator-supplied password/path arguments, configurable partial encryption, service shutdown, persistence and a ransom-note workflow.\n\nReverse-engineering findings:\nThe encryption tool requires password and target-path arguments and provides delay, silent, keep and wipe options, plus partial-encryption modes covering 27%, 9%, 3% or 1% of a file. The report identifies an embedded X25519 public key and linked AES, SHA and HMAC routines.\n\nA pre-encryption command sequence mounts selected storage, stops Docker and Podman containers, powers off Nutanix guests, stops database services and Synology packages, and removes multiple log and recovery-related locations. The report also maps gautostart.service and an @reboot cron entry.\n\n`README-GENTLEMEN.txt` supplies a victim identifier and negotiation contacts: a Tor site, a clearnet mirror, a SimpleX invitation and a TOX identifier. The feed labels them as ransom-note contacts; they are not identified as the executable's command channel.\n\nEvidence scope: Ransom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\n\nAnalysis record: reverse_engineering_report_available; retrieved 2026-11-09T09:02:26.551373+00:00\n\nReported attribution context: Russian-speaking ransomware operation according to Check Point\nThe cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nSources:\nhttps://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/\nhttps://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/\n\nSpecimens:\n[\n {\n \"id\": \"sha256:53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\",\n \"case_id\": \"gentlemen\",\n \"role\": \"primary\",\n \"hashes\": {\n \"sha256\": \"53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa\",\n \"sha1\": \"4cf4ba5a575b8f153cfa34ceef6006436dbbf432\",\n \"md5\": \"093f63c3a11f9ff01de82f3bbf27be17\"\n },\n \"hash_verification\": \"SHA-256, SHA-1 and MD5 recomputed from retained encrypted archives in memory; no extraction to executable files and no execution\",\n \"size_bytes\": 2490504,\n \"catalog_filename\": \"boom\",\n \"catalog_file_type\": \"elf\",\n \"catalog_first_seen_utc\": \"2026-10-22T18:10:35Z\",\n \"parent_sha256\": null,\n \"analysis_status_at_snapshot\": \"completed\",\n \"reverse_engineering_status_at_snapshot\": \"complete\",\n \"analysis_snapshot_utc\": \"2026-11-09T09:02:26.337631+00:00\",\n \"malwarebazaar_url\": \"https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/\",\n \"live_execution_observed_by_us\": false,\n \"analysis_id\": \"f-aaf78f0da53a53eb39163ea0954ad7b3eb90f9d91a663a3d347e627b1ce30bdf-1794166976766297375\",\n \"report_id\": \"gentlemen\",\n \"report_source_sha256\": \"719ba78f6fb14307d5996c0acf311557038683cbea1cc59457928eced0995c8b\"\n }\n]", "timestamp": "1794239233" }, { "uuid": "92d660a5-d5ba-5b25-8271-03bb39d0c44b", "distribution": "5", "name": "Import notes and correlation boundaries", "content": "71 reviewed indicators, 140 case-specific contextual observations deduplicated into 135 contextual attributes. All to_ids flags are false. No automatic blocking. Event is unpublished; distribution 0 limits onward sharing on import. Catalog first-seen dates are not victim sightings. No live endpoint revalidation was performed. MISP URL attributes contain base paths; ChocoShell query variants require normalisation as described in match_semantics. STIX preserves the corresponding URL matching patterns. Hash confidence is distinct from actor attribution. The independently verified shared loader passphrase links Covenant-tagged and PixyNetLoader specimens, but proves neither a common operator nor shared C2.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "timestamp": "1794239233" } ], "Tag": [ { "name": "beelzebub:analysis-refresh=\"2026-11-09\"" }, { "name": "beelzebub:language=\"en\"" }, { "name": "beelzebub:usage=\"retrospective-hunting\"" }, { "name": "beelzebub:review=\"analyst-promotion-required\"" } ], "info": "Beelzebub: 17 Russia-linked and Russian-speaking ecosystem cases — refreshed 9 Nov 2026", "distribution": "0", "threat_level_id": "4", "analysis": "1", "published": false, "date": "2026-11-09", "Orgc": { "uuid": "ecc0490e-5dd8-45ab-9131-3cc0249139af", "name": "Beelzebub Labs — research export" }, "timestamp": "1794239233" } }