{ "type": "bundle", "id": "bundle--bf046852-ce8a-55e2-9f67-eeb1f536e2c9", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "name": "Beelzebub Labs", "identity_class": "organization" }, { "type": "file", "spec_version": "2.1", "id": "file--ed09db9e-7e4f-532b-8fff-3541f60e1aeb", "hashes": { "SHA-256": "9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927", "SHA-1": "e27e0d0a4b308f9b6b0469159931eb5e343e7ff8", "MD5": "388374f8478203844f854ffe213f7a47" }, "size": 3212016, "name": "додаток податкова.xlsm" }, { "type": "malware", "spec_version": "2.1", "id": "malware--c2924da1-4b83-590b-af42-8c9b118dfbc2", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook — specimen 9ce0f41d6e57", "is_family": false, "malware_types": [ "downloader" ], "sample_refs": [ "file--ed09db9e-7e4f-532b-8fff-3541f60e1aeb" ], "description": "An XLSM delivery workbook reconstructs a PE payload that collects browser data, OpenVPN configuration and documents, with Telegram Bot API upload logic.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ], "labels": [ "sample-specific", "reviewed-evidence", "workbook_and_recovered_payload_reviewed" ] }, { "type": "file", "spec_version": "2.1", "id": "file--4a984f0d-2dcf-54fa-b01b-ac7cfc45b8d9", "hashes": { "SHA-256": "49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495", "SHA-1": "512920c5e31d08d65940877bdb29d0a17738ce37", "MD5": "39cc6af95d0425f160571032a6719ad3" }, "size": 39811, "name": "0032.doc" }, { "type": "malware", "spec_version": "2.1", "id": "malware--693e117f-6c6c-53bf-937e-b9d5457d2643", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE — specimen 49e276498fc4", "is_family": false, "malware_types": [ "backdoor" ], "sample_refs": [ "file--4a984f0d-2dcf-54fa-b01b-ac7cfc45b8d9" ], "description": "Office delivery document and reconstructed batch client using an off-screen Edge window for task retrieval and a separate webhook path for result submission.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--12a374a1-e2af-577d-8ede-e78885f6d173", "hashes": { "SHA-256": "c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86", "SHA-1": "fbfaff2e2ed7ac6608c1a7bb2055941d54c52a92", "MD5": "3078d19a4860184eaac43cb45622672f" }, "size": 218112, "name": "default-20241101-1112.dll" }, { "type": "malware", "spec_version": "2.1", "id": "malware--d0d67e70-9d0e-50f8-8171-fab51814fc7f", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Covenant-tagged proxy loader — specimen c03f09eda8c1", "is_family": false, "malware_types": [ "downloader" ], "sample_refs": [ "file--12a374a1-e2af-577d-8ede-e78885f6d173" ], "description": "An IDStore.dll proxy loader uses the resolvefree mutex and a HIDE container in icon.png, deriving an AES key with PBKDF2 before calling the recovered stage in memory.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--7d33e64a-c97c-5e91-88ca-79e6b7f68cdd", "hashes": { "SHA-256": "d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11", "SHA-1": "f01698a5e796c1f541e82bf4ff6823f3f72f58a9", "MD5": "eb0da1bf4db13bbb8bc8fbf752274746" }, "size": 572416, "name": "file" }, { "type": "malware", "spec_version": "2.1", "id": "malware--7fb45087-f8ab-57ba-9907-4088f40e01df", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Matchboil — specimen d0f40958cc03", "is_family": false, "malware_types": [ "downloader" ], "sample_refs": [ "file--7d33e64a-c97c-5e91-88ca-79e6b7f68cdd" ], "description": "A protected .NET loader resolves native APIs dynamically, handles encrypted resources and invokes assemblies in memory through a flattened managed-code control flow.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--3185132a-30ee-5cae-ac9b-52dbd561b24c", "hashes": { "SHA-256": "708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73", "SHA-1": "4a1aa20a1d998235e1dab81f124ce6c6d79656a2", "MD5": "9a30c5d73737a637058fcf8468541a2f" }, "size": 1305670, "name": "7ZSfxMod_x86.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gamaredon / UltraVNC package — specimen 708eb1588851", "is_family": false, "malware_types": [ "remote-access-trojan" ], "sample_refs": [ "file--3185132a-30ee-5cae-ac9b-52dbd561b24c" ], "description": "A weaponized 7-Zip SFX package deploys a renamed UltraVNC server and configures an outbound reverse-VNC connection to seemsurprise.com:443.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nUltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--a0db5f14-9729-5d6a-8a07-bfd1ca212e9e", "hashes": { "SHA-256": "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593", "SHA-1": "510af9bb00ff5d4a6856b1291af55db9f6e13551", "MD5": "fba867df17721879df9d8dcca68d6900" }, "size": 8113978, "name": "123.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--08dc59e1-c708-5fd9-87ef-d7d991e755b6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "CornFlake catalog specimen — specimen 918fa52ae45e", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--a0db5f14-9729-5d6a-8a07-bfd1ca212e9e" ], "description": "The CornFlake catalog specimen is described by Caronte as a Go RemusStealer-style infostealer/RAT, with browser and SSH collection, surveillance features and a configurable WebSocket channel.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nCornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--8905028a-5645-50b3-9b93-0544448bc9cb", "hashes": { "SHA-256": "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c", "SHA-1": "937e75e0e1c82eecab69e9b8ad481bd7e0845308", "MD5": "c6f4df18cb880500f3921a179c3a3766" }, "size": 55877, "name": "123.ps1" }, { "type": "malware", "spec_version": "2.1", "id": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell — specimen be99857449d2", "is_family": false, "malware_types": [ "spyware" ], "sample_refs": [ "file--8905028a-5645-50b3-9b93-0544448bc9cb" ], "description": "A PowerShell infostealer collects browser credentials and cookies, Microsoft token-cache data and WiFi credentials, with a configured HTTPS upload workflow.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--03c4b02b-ac23-5a85-ac26-3ec4c7b9a54b", "hashes": { "SHA-256": "78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8", "SHA-1": "a5e0a82bf6cc302a20d917235643b748f73fcc27", "MD5": "0a178f76c48c038e8bad03a62b52cfc9" }, "size": 43008, "name": "wintel" }, { "type": "malware", "spec_version": "2.1", "id": "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Prime ReverseShell — specimen 78ea83bfbca8", "is_family": false, "malware_types": [ "backdoor" ], "sample_refs": [ "file--03c4b02b-ac23-5a85-ac26-3ec4c7b9a54b" ], "description": "A PS2EXE-style .NET host loads nnnnrth.ps1, waits about eight minutes and opens a TCP reverse shell to 89.44.9.186:3240.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nUse the destination and port from the TcpClient path; other address literals and the Host header have separate roles.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--505418cd-261d-5904-a181-6aedd958190b", "hashes": { "SHA-256": "c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5", "SHA-1": "e457641615b548c315913fac7e8255519e50687f", "MD5": "b077401fe3d9642345d4c3deafa60aa5" }, "size": 232960, "name": "EdgeSyncPr.dll" }, { "type": "malware", "spec_version": "2.1", "id": "malware--5da41fbe-da48-54c7-8c0e-56ab5ad47b77", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "PixyNetLoader — specimen c6f13923f131", "is_family": false, "malware_types": [ "downloader" ], "sample_refs": [ "file--505418cd-261d-5904-a181-6aedd958190b" ], "description": "An EdgeSyncPr.dll proxy loader extracts an encrypted stage from EdgeLogo.png and shares a verified passphrase with the Covenant-tagged DLL.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/" }, { "source_name": "Public research and attribution", "url": "https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--0b7dcbc2-d666-581b-877f-b8a3a757785b", "hashes": { "SHA-256": "d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160", "SHA-1": "69ede7e341fd26fa0577692b601d80cb44778d93", "MD5": "c4379da51e8b9e86ec3de934f9373f4a" }, "size": 167424, "name": "schtask.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--d8c056ef-d325-5dce-9925-870aead61ebc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "DynoWiper — specimen d1389a1ff652", "is_family": false, "malware_types": [ "wiper" ], "sample_refs": [ "file--0b7dcbc2-d666-581b-877f-b8a3a757785b" ], "description": "A Windows disk wiper enumerates fixed and removable drives, overwrites file content using a PRNG-generated pattern and performs a subsequent deletion pass.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--d123f6d5-24c0-55c4-abca-b1cac2d37d68", "hashes": { "SHA-256": "30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9", "SHA-1": "1158d28851adc223b7cc93fcc9585381fe53be34", "MD5": "3837b2ae95f88ec677f83fa95ac50a79" }, "size": 466944, "name": "3837B2AE95F88EC677F83FA95AC50A79.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--69700569-e2fd-5de4-8dbc-01c4cacc88e8", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LummaStealer catalog specimen — specimen 30a8365303ef", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--d123f6d5-24c0-55c4-abca-b1cac2d37d68" ], "description": "A hash-verified LummaStealer catalog specimen with I386 PE structure and a retained static and reputation graph.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nAvailable coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/" }, { "source_name": "Public research and attribution", "url": "https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/" } ], "labels": [ "sample-specific", "reviewed-evidence", "static_identification" ] }, { "type": "file", "spec_version": "2.1", "id": "file--8381ece1-dbe4-51c2-b6ce-a2bd52f49525", "hashes": { "SHA-256": "1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5", "SHA-1": "66d0a00577a6e7415cfb21b4cf88805bedc34889", "MD5": "a5c45448100c2a173f73d339bbee9b47" }, "size": 97792, "name": "A5C45448100C2A173F73D339BBEE9B47.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--e556115b-e426-5e86-8967-0bb4ec693014", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "RedLineStealer — specimen 1d48be9c0383", "is_family": false, "malware_types": [ "spyware" ], "sample_refs": [ "file--8381ece1-dbe4-51c2-b6ce-a2bd52f49525" ], "description": "A managed RedLine-style infostealer implements browser and wallet collection, host profiling and a WCF task-processing workflow.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\n194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--88917cf0-5b48-5a1e-b316-3b8a25c357b5", "hashes": { "SHA-256": "99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658", "SHA-1": "b2b0244b03e80a3e3b355a535411faf3bf4fce74", "MD5": "1dff89c029b823fa2a3b488d4a57affb" }, "size": 267264, "name": "ThermoCalc2026a-CrackedBy-DoCrackMe.exe.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen — specimen 99b41a3ffef3", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--88917cf0-5b48-5a1e-b316-3b8a25c357b5" ], "description": "A Windows specimen catalog-labelled LockBit (Caronte family confidence: possible) decodes stack-built strings, resolves APIs by hash, removes shadow copies and gates file encryption on an HTTPS response from docrack.me.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--85b594b8-6d12-50a5-828a-9bdbdfac7805", "hashes": { "SHA-256": "d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2", "SHA-1": "ccea4b815266482209f16026a128254ddc2a029d", "MD5": "39f48fdc2fe7c7bb82cb0c9917201104" }, "size": 4780992, "name": "Dol-stBootV2.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--92852673-9316-5e89-b724-03e7238c43c4", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Vidar catalog specimen — specimen d458e481a291", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--85b594b8-6d12-50a5-828a-9bdbdfac7805" ], "description": "The Vidar catalog specimen is a Go executable with obfuscated application identifiers, indirect API resolution and large unreferenced padding regions.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nVidar is the catalog context. The reported code findings describe the acquired Go artifact.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--d35a98db-1e41-553b-9a53-c97425bd4552", "hashes": { "SHA-256": "0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f", "SHA-1": "bc5b95e545b7911a252328ae98bbbd9ea8270e18", "MD5": "bfd9de847fe1fa7e1716cde61c9ac0b0" }, "size": 3443648, "name": "OurNew.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--5aaacca0-b42f-53f9-b0e5-17fdab2056ff", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Stealc catalog specimen — specimen 0d3c25a7842f", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--d35a98db-1e41-553b-9a53-c97425bd4552" ], "description": "The Stealc catalog specimen is a Go 1.21.1 executable with selectively renamed application symbols and synthetic high-entropy padding.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nStealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--3123c05a-ff95-5446-b7e3-8370825304db", "hashes": { "SHA-256": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5", "SHA-1": "ef2ea8de20d62f06aae88341da12c1b35dd5cb3d", "MD5": "68855abb0d31bd2ff47a95a18ec255c3" }, "size": 766976, "name": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5" }, { "type": "malware", "spec_version": "2.1", "id": "malware--852ebd13-8b05-5686-b387-2e7842854f58", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens — specimen 6e837d22a6be", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--3123c05a-ff95-5446-b7e3-8370825304db" ], "description": "The smaller Rhadamanthys catalog specimen is an AES-packed x64 loader with a runtime function-pointer table, memory-protection changes and mixed boolean-arithmetic obfuscation.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ], "labels": [ "sample-specific", "reviewed-evidence", "smaller_specimen_loader_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--ac8d5c2c-9e4f-545d-bf63-ff3df8b4a820", "hashes": { "SHA-256": "53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa", "SHA-1": "4cf4ba5a575b8f153cfa34ceef6006436dbbf432", "MD5": "093f63c3a11f9ff01de82f3bbf27be17" }, "size": 2490504, "name": "boom" }, { "type": "malware", "spec_version": "2.1", "id": "malware--9ff992ee-9f41-5739-a5d1-ffb624df0c79", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "The Gentlemen — specimen 53d2484ae1ad", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--ac8d5c2c-9e4f-545d-bf63-ff3df8b4a820" ], "description": "A Go Linux ransomware executable combines operator-supplied password/path arguments, configurable partial encryption, service shutdown, persistence and a ransom-note workflow.\nSpecimen role: primary. Findings are scoped to the file identities stated in the case record.\nRansom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/" }, { "source_name": "Public research and attribution", "url": "https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--e5134e9d-08eb-55a0-9756-adc256dd93dc", "hashes": { "SHA-256": "df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77", "SHA-1": "ebcd20d46b40734a03e645779875f1fe87882442", "MD5": "4f244724e3ac2aae8d39f72e911a9a22" }, "size": 815616, "name": "df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77.exe" }, { "type": "malware", "spec_version": "2.1", "id": "malware--e92ea0ca-d905-5870-9410-4c7a86057b8f", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook — specimen df3f034df512", "is_family": false, "malware_types": [ "downloader" ], "sample_refs": [ "file--e5134e9d-08eb-55a0-9756-adc256dd93dc" ], "description": "An XLSM delivery workbook reconstructs a PE payload that collects browser data, OpenVPN configuration and documents, with Telegram Bot API upload logic.\nSpecimen role: derived. Findings are scoped to the file identities stated in the case record.\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ], "labels": [ "sample-specific", "reviewed-evidence", "workbook_and_recovered_payload_reviewed" ] }, { "type": "file", "spec_version": "2.1", "id": "file--ef480ddf-fecf-5802-ae71-8338344d1214", "hashes": { "SHA-256": "2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a", "SHA-1": "f7ce179447d9693adb10341726989b3b016d4360", "MD5": "cb040464587c7901926169d8e046fad8" }, "size": 1160, "name": "2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a.bat" }, { "type": "malware", "spec_version": "2.1", "id": "malware--043f648a-f5a6-5068-b1fd-61bd9bef8321", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE — specimen 2e81945ba271", "is_family": false, "malware_types": [ "backdoor" ], "sample_refs": [ "file--ef480ddf-fecf-5802-ae71-8338344d1214" ], "description": "Office delivery document and reconstructed batch client using an off-screen Edge window for task retrieval and a separate webhook path for result submission.\nSpecimen role: derived. Findings are scoped to the file identities stated in the case record.\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ], "labels": [ "sample-specific", "reviewed-evidence", "reverse_engineering_report_available" ] }, { "type": "file", "spec_version": "2.1", "id": "file--8a024b54-e855-5a46-8079-707c7c1ac3f5", "hashes": { "SHA-256": "7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad", "SHA-1": "87596edc57173f151068404152eb50212c768c96", "MD5": "73c940e6cb2ff49f8e8c145524c41fd8" }, "size": 32276994, "name": "7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad" }, { "type": "malware", "spec_version": "2.1", "id": "malware--47c27712-1816-58ca-856c-4bf7cd81e826", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens — specimen 7ca011030bdb", "is_family": false, "malware_types": [ "unknown" ], "sample_refs": [ "file--8a024b54-e855-5a46-8079-707c7c1ac3f5" ], "description": "The smaller Rhadamanthys catalog specimen is an AES-packed x64 loader with a runtime function-pointer table, memory-protection changes and mixed boolean-arithmetic obfuscation.\nSpecimen role: alternative. Findings are scoped to the file identities stated in the case record.\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.", "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ], "labels": [ "sample-specific", "reviewed-evidence", "smaller_specimen_loader_report_available" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e982b5ab-fd2b-5d7b-858b-f65ba6766c5b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook / SHA256 9ce0f41d6e57", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ed3fd395-eccf-5772-b5fa-10da99d56683", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--e982b5ab-fd2b-5d7b-858b-f65ba6766c5b", "target_ref": "malware--c2924da1-4b83-590b-af42-8c9b118dfbc2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--338e1ae2-0cf0-5392-84b3-d27fee129c35", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook / SHA1 e27e0d0a4b30", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'e27e0d0a4b308f9b6b0469159931eb5e343e7ff8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18859e67-542f-56e8-b253-4f53e8cab865", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--338e1ae2-0cf0-5392-84b3-d27fee129c35", "target_ref": "malware--c2924da1-4b83-590b-af42-8c9b118dfbc2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fb2cf0aa-9609-53cc-98c1-6a159cc0c4d3", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook / MD5 388374f84782", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '388374f8478203844f854ffe213f7a47']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f02cab1-c4de-5563-85c6-d27627b79c2b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--fb2cf0aa-9609-53cc-98c1-6a159cc0c4d3", "target_ref": "malware--c2924da1-4b83-590b-af42-8c9b118dfbc2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--26e4cc63-ca28-5af8-a505-5670ff05dc86", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / SHA256 49e276498fc4", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e466b59-eedf-5963-ba4d-eb9038fac953", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--26e4cc63-ca28-5af8-a505-5670ff05dc86", "target_ref": "malware--693e117f-6c6c-53bf-937e-b9d5457d2643" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--28c78462-3110-5522-a109-badf8885c51c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / SHA1 512920c5e31d", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '512920c5e31d08d65940877bdb29d0a17738ce37']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e4e9775-f3dc-5a8c-b167-1b41f60dfbbc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--28c78462-3110-5522-a109-badf8885c51c", "target_ref": "malware--693e117f-6c6c-53bf-937e-b9d5457d2643" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--55e39c16-8d3e-54a6-85cd-2c4c017172ef", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / MD5 39cc6af95d04", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '39cc6af95d0425f160571032a6719ad3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e201f740-00f2-5718-a9df-34d6498d7a73", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--55e39c16-8d3e-54a6-85cd-2c4c017172ef", "target_ref": "malware--693e117f-6c6c-53bf-937e-b9d5457d2643" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--04ae9f33-caf4-5c29-8238-601c522567ed", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Covenant-tagged proxy loader / SHA256 c03f09eda8c1", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7f65451c-543c-5aaa-b4c3-eec3cd9136ad", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--04ae9f33-caf4-5c29-8238-601c522567ed", "target_ref": "malware--d0d67e70-9d0e-50f8-8171-fab51814fc7f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ec79c2b0-8f9c-555b-a1d2-7146c3825327", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Covenant-tagged proxy loader / SHA1 fbfaff2e2ed7", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'fbfaff2e2ed7ac6608c1a7bb2055941d54c52a92']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--52cd4393-e797-5f24-bfa6-fa659c4d8853", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--ec79c2b0-8f9c-555b-a1d2-7146c3825327", "target_ref": "malware--d0d67e70-9d0e-50f8-8171-fab51814fc7f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--df4ba604-84e7-5e7d-a18e-548efd82c72b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Covenant-tagged proxy loader / MD5 3078d19a4860", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '3078d19a4860184eaac43cb45622672f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4f56a9d-c403-5803-adeb-e81b9e0cfc95", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--df4ba604-84e7-5e7d-a18e-548efd82c72b", "target_ref": "malware--d0d67e70-9d0e-50f8-8171-fab51814fc7f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d1b8c64d-a91b-589f-b4b7-f842283e0ed6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Matchboil / SHA256 d0f40958cc03", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'd0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9322bfd-d817-53a5-aac4-1c1e6f3e6474", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--d1b8c64d-a91b-589f-b4b7-f842283e0ed6", "target_ref": "malware--7fb45087-f8ab-57ba-9907-4088f40e01df" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aeef5bbe-2ff6-5d84-a990-8666309b8dc2", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Matchboil / SHA1 f01698a5e796", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'f01698a5e796c1f541e82bf4ff6823f3f72f58a9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1514fc36-0377-5dfa-aa0e-dc9e79e05bba", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--aeef5bbe-2ff6-5d84-a990-8666309b8dc2", "target_ref": "malware--7fb45087-f8ab-57ba-9907-4088f40e01df" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eea5c0b6-cb0f-585b-b016-9f2915c90b44", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Matchboil / MD5 eb0da1bf4db1", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'eb0da1bf4db13bbb8bc8fbf752274746']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7ccd97ce-bf1f-515f-a2ab-2a9ba2769912", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--eea5c0b6-cb0f-585b-b016-9f2915c90b44", "target_ref": "malware--7fb45087-f8ab-57ba-9907-4088f40e01df" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--01ae6184-9a47-5c35-9617-4147960d746a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gamaredon / UltraVNC package / SHA256 708eb1588851", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nUltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--30c66501-845a-54ac-a0bd-e151b7fd59a2", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--01ae6184-9a47-5c35-9617-4147960d746a", "target_ref": "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--40e29947-5e09-56a3-87b7-9b4069f7009f", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gamaredon / UltraVNC package / SHA1 4a1aa20a1d99", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nUltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '4a1aa20a1d998235e1dab81f124ce6c6d79656a2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9eedcc6-5583-5586-b423-6d3e01d75f4c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--40e29947-5e09-56a3-87b7-9b4069f7009f", "target_ref": "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f61a7815-fde8-55e8-aace-8a49cef60b7b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gamaredon / UltraVNC package / MD5 9a30c5d73737", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nUltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '9a30c5d73737a637058fcf8468541a2f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c6eeeecf-b2b1-58fc-b49a-9979aaceda60", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f61a7815-fde8-55e8-aace-8a49cef60b7b", "target_ref": "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--70ce193e-5e7b-5ba3-a2b7-613dc93e9e11", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "CornFlake catalog specimen / SHA256 918fa52ae45e", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nCornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0151ec5a-ef84-5dd0-b363-166d5c42059e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--70ce193e-5e7b-5ba3-a2b7-613dc93e9e11", "target_ref": "malware--08dc59e1-c708-5fd9-87ef-d7d991e755b6" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f14176b8-e5ed-59d5-859c-ca3d10b88f93", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "CornFlake catalog specimen / SHA1 510af9bb00ff", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nCornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '510af9bb00ff5d4a6856b1291af55db9f6e13551']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40ba86ac-1823-5bf4-bbe4-eab1aa578196", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f14176b8-e5ed-59d5-859c-ca3d10b88f93", "target_ref": "malware--08dc59e1-c708-5fd9-87ef-d7d991e755b6" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4d914eb8-85b1-54c3-9eef-50b867675352", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "CornFlake catalog specimen / MD5 fba867df1772", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nCornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'fba867df17721879df9d8dcca68d6900']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ab245832-9212-533a-b11b-53834f4e7ee0", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--4d914eb8-85b1-54c3-9eef-50b867675352", "target_ref": "malware--08dc59e1-c708-5fd9-87ef-d7d991e755b6" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3214275b-b41b-52db-a5fa-c5852520a36c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / SHA256 be99857449d2", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--42e3387e-b58c-52ec-916a-2de6cd9404ac", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--3214275b-b41b-52db-a5fa-c5852520a36c", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--41e84d06-4b86-5c30-86be-cffa06510f3d", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / SHA1 937e75e0e1c8", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '937e75e0e1c82eecab69e9b8ad481bd7e0845308']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--163f67ca-683a-5ca8-98d6-1a48b50b674f", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--41e84d06-4b86-5c30-86be-cffa06510f3d", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f7fd1d3c-874f-59ca-95b8-7e77528d7725", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / MD5 c6f4df18cb88", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'c6f4df18cb880500f3921a179c3a3766']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29ef5063-214f-541d-8655-22f5049cf576", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f7fd1d3c-874f-59ca-95b8-7e77528d7725", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e9d4eb02-a52d-5a96-a026-10a7acb2bcc5", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Prime ReverseShell / SHA256 78ea83bfbca8", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nUse the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2cdca581-c59b-540a-bdf1-b7988cac5a76", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--e9d4eb02-a52d-5a96-a026-10a7acb2bcc5", "target_ref": "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--20b683a2-b477-5346-8024-93c05936702b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Prime ReverseShell / SHA1 a5e0a82bf6cc", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nUse the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'a5e0a82bf6cc302a20d917235643b748f73fcc27']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a2364227-1a9d-59ec-a90e-924781902eb1", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--20b683a2-b477-5346-8024-93c05936702b", "target_ref": "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0d4e46aa-c046-53dd-b666-0ba4ed637e71", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Prime ReverseShell / MD5 0a178f76c48c", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nUse the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '0a178f76c48c038e8bad03a62b52cfc9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f590a24-0bfa-56ad-b8ba-f8af02d88bbd", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--0d4e46aa-c046-53dd-b666-0ba4ed637e71", "target_ref": "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a57b6716-0fca-5a19-8d20-13d77fd0e19d", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "PixyNetLoader / SHA256 c6f13923f131", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/" }, { "source_name": "Public research and attribution", "url": "https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2cbe865f-b3b5-574a-898d-5e8c7d844dad", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--a57b6716-0fca-5a19-8d20-13d77fd0e19d", "target_ref": "malware--5da41fbe-da48-54c7-8c0e-56ab5ad47b77" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7e2684d1-d869-564e-8457-3ff0b216f55e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "PixyNetLoader / SHA1 e457641615b5", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'e457641615b548c315913fac7e8255519e50687f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/" }, { "source_name": "Public research and attribution", "url": "https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c446f4d-cb9d-5311-9cba-c503b04591d3", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--7e2684d1-d869-564e-8457-3ff0b216f55e", "target_ref": "malware--5da41fbe-da48-54c7-8c0e-56ab5ad47b77" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--72febc9a-300e-540a-81e1-16ad30fff5fc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "PixyNetLoader / MD5 b077401fe3d9", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'b077401fe3d9642345d4c3deafa60aa5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/" }, { "source_name": "Public research and attribution", "url": "https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--658e3548-64ea-5e83-af83-914f6dc59cb7", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--72febc9a-300e-540a-81e1-16ad30fff5fc", "target_ref": "malware--5da41fbe-da48-54c7-8c0e-56ab5ad47b77" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--003cc180-fc81-57b0-a166-1014b9d2b8c5", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "DynoWiper / SHA256 d1389a1ff652", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'd1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50e91ee7-4e07-5535-8265-7e6e7f34edcf", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--003cc180-fc81-57b0-a166-1014b9d2b8c5", "target_ref": "malware--d8c056ef-d325-5dce-9925-870aead61ebc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8ed9144c-aedd-502c-8e3f-e00162af0a53", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "DynoWiper / SHA1 69ede7e341fd", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '69ede7e341fd26fa0577692b601d80cb44778d93']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4bcb238f-2ccf-58cc-9092-99a90da2f765", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--8ed9144c-aedd-502c-8e3f-e00162af0a53", "target_ref": "malware--d8c056ef-d325-5dce-9925-870aead61ebc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--94db7a9e-3d81-5e00-a1d7-a9a8aa86bf6b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "DynoWiper / MD5 c4379da51e8b", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'c4379da51e8b9e86ec3de934f9373f4a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e26484c9-6572-58eb-bc96-f50902aab7a8", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--94db7a9e-3d81-5e00-a1d7-a9a8aa86bf6b", "target_ref": "malware--d8c056ef-d325-5dce-9925-870aead61ebc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0767258a-927f-57ac-ba04-ca6b3a69129a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LummaStealer catalog specimen / SHA256 30a8365303ef", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nAvailable coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/" }, { "source_name": "Public research and attribution", "url": "https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2d480a8a-9b3e-5cd3-831e-5da136cfba11", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--0767258a-927f-57ac-ba04-ca6b3a69129a", "target_ref": "malware--69700569-e2fd-5de4-8dbc-01c4cacc88e8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--46b76715-f3aa-5c57-b7d9-3a4cc7bdf3a5", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LummaStealer catalog specimen / SHA1 1158d28851ad", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nAvailable coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '1158d28851adc223b7cc93fcc9585381fe53be34']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/" }, { "source_name": "Public research and attribution", "url": "https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee501184-c843-5c34-945b-b5ed9a7b7b01", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--46b76715-f3aa-5c57-b7d9-3a4cc7bdf3a5", "target_ref": "malware--69700569-e2fd-5de4-8dbc-01c4cacc88e8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--295bbf9e-7e1a-5315-8ff5-e50242eda7ad", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LummaStealer catalog specimen / MD5 3837b2ae95f8", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nAvailable coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '3837b2ae95f88ec677f83fa95ac50a79']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/" }, { "source_name": "Public research and attribution", "url": "https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b472882-7d34-54ae-9a20-c08292c577ee", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--295bbf9e-7e1a-5315-8ff5-e50242eda7ad", "target_ref": "malware--69700569-e2fd-5de4-8dbc-01c4cacc88e8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1dd6db8f-df87-52c2-9f6d-5225364686fe", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "RedLineStealer / SHA256 1d48be9c0383", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\n194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--59a8be57-f958-54e3-9c7d-26a650c5149b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--1dd6db8f-df87-52c2-9f6d-5225364686fe", "target_ref": "malware--e556115b-e426-5e86-8967-0bb4ec693014" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f9773a2e-6d82-56cd-90f8-edaf10a90409", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "RedLineStealer / SHA1 66d0a00577a6", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\n194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '66d0a00577a6e7415cfb21b4cf88805bedc34889']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--944fe4ad-9409-5d2a-877b-1062951e3dfd", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f9773a2e-6d82-56cd-90f8-edaf10a90409", "target_ref": "malware--e556115b-e426-5e86-8967-0bb4ec693014" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--01fd8b5b-6c3a-5999-b822-c946808792b4", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "RedLineStealer / MD5 a5c45448100c", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\n194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'a5c45448100c2a173f73d339bbee9b47']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f42ee477-17f5-5dc6-a8d9-04051721b2e0", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--01fd8b5b-6c3a-5999-b822-c946808792b4", "target_ref": "malware--e556115b-e426-5e86-8967-0bb4ec693014" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d5802b7-7859-5378-8e95-be8cdcbf8d06", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen / SHA256 99b41a3ffef3", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dfab7f38-85c2-54c7-bd0e-e8b9e1e2795a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--5d5802b7-7859-5378-8e95-be8cdcbf8d06", "target_ref": "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f6367393-ae10-5d49-ae5f-1438b9b6c18b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen / SHA1 b2b0244b03e8", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'b2b0244b03e80a3e3b355a535411faf3bf4fce74']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4058de0c-7dc8-593e-a79d-0afb3e4edc66", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f6367393-ae10-5d49-ae5f-1438b9b6c18b", "target_ref": "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f1eb744f-7d9c-5894-a42e-3f3f80b4a116", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen / MD5 1dff89c029b8", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '1dff89c029b823fa2a3b488d4a57affb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d4a78b60-5d09-5bf0-8872-85e3deda6b7b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f1eb744f-7d9c-5894-a42e-3f3f80b4a116", "target_ref": "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--685d8e16-9123-5d89-a5ec-85b4c556f50e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Vidar catalog specimen / SHA256 d458e481a291", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nVidar is the catalog context. The reported code findings describe the acquired Go artifact.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'd458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4835ad3f-a4f7-54d6-9da5-656b3705cc64", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--685d8e16-9123-5d89-a5ec-85b4c556f50e", "target_ref": "malware--92852673-9316-5e89-b724-03e7238c43c4" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--00d5e2ef-916c-58ca-8cbc-9555c0625268", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Vidar catalog specimen / SHA1 ccea4b815266", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nVidar is the catalog context. The reported code findings describe the acquired Go artifact.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'ccea4b815266482209f16026a128254ddc2a029d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d1c58fc-2cdc-5d48-801b-0a83176cf9dd", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--00d5e2ef-916c-58ca-8cbc-9555c0625268", "target_ref": "malware--92852673-9316-5e89-b724-03e7238c43c4" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b960d958-1af9-560b-bc02-82ca103fa2f6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Vidar catalog specimen / MD5 39f48fdc2fe7", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nVidar is the catalog context. The reported code findings describe the acquired Go artifact.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '39f48fdc2fe7c7bb82cb0c9917201104']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38bcbaca-95eb-50de-8b1f-bd5a337b23cd", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--b960d958-1af9-560b-bc02-82ca103fa2f6", "target_ref": "malware--92852673-9316-5e89-b724-03e7238c43c4" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f47960d5-1745-5a1c-97a2-739a51181f29", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Stealc catalog specimen / SHA256 0d3c25a7842f", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nStealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8711148e-1465-5729-8693-cb468e213f0c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f47960d5-1745-5a1c-97a2-739a51181f29", "target_ref": "malware--5aaacca0-b42f-53f9-b0e5-17fdab2056ff" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4ac4c28-d56f-5e86-a193-2b6e2bb24047", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Stealc catalog specimen / SHA1 bc5b95e545b7", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nStealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'bc5b95e545b7911a252328ae98bbbd9ea8270e18']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e1502e3-a4c1-5fec-8b12-04faec7059a0", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f4ac4c28-d56f-5e86-a193-2b6e2bb24047", "target_ref": "malware--5aaacca0-b42f-53f9-b0e5-17fdab2056ff" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--09147ef2-7864-5df7-a0ab-23b04e643183", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Stealc catalog specimen / MD5 bfd9de847fe1", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nStealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'bfd9de847fe1fa7e1716cde61c9ac0b0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f0504088-cf13-5434-91af-b7f7e2aa32f0", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--09147ef2-7864-5df7-a0ab-23b04e643183", "target_ref": "malware--5aaacca0-b42f-53f9-b0e5-17fdab2056ff" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c8290309-e36b-541f-b584-cbdeebe58e1c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens / SHA256 6e837d22a6be", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--487ad89a-4573-5e0e-b3c3-41c0462a639c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--c8290309-e36b-541f-b584-cbdeebe58e1c", "target_ref": "malware--852ebd13-8b05-5686-b387-2e7842854f58" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aa4045f1-0514-57cf-b72d-e8cc2cc415e6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens / SHA1 ef2ea8de20d6", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'ef2ea8de20d62f06aae88341da12c1b35dd5cb3d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ef1054de-01f7-5915-8ad3-0868a6cdff80", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--aa4045f1-0514-57cf-b72d-e8cc2cc415e6", "target_ref": "malware--852ebd13-8b05-5686-b387-2e7842854f58" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d11694e-16a4-52e1-b6a8-ba7a7f4a3fcc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens / MD5 68855abb0d31", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '68855abb0d31bd2ff47a95a18ec255c3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a65e43f0-7dce-5f17-a635-a2362c6659f3", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--3d11694e-16a4-52e1-b6a8-ba7a7f4a3fcc", "target_ref": "malware--852ebd13-8b05-5686-b387-2e7842854f58" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f8748750-e330-5863-baf7-1bd6b9e1cf98", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "The Gentlemen / SHA256 53d2484ae1ad", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nRansom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/" }, { "source_name": "Public research and attribution", "url": "https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df940d64-097d-52e5-88cd-1550da9075cc", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f8748750-e330-5863-baf7-1bd6b9e1cf98", "target_ref": "malware--9ff992ee-9f41-5739-a5d1-ffb624df0c79" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f1f74d0-f699-54e2-8f69-9bad6893bbd6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "The Gentlemen / SHA1 4cf4ba5a575b", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nRansom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '4cf4ba5a575b8f153cfa34ceef6006436dbbf432']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/" }, { "source_name": "Public research and attribution", "url": "https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ace8d2f-414c-5282-af65-9d1cd4722ba6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--0f1f74d0-f699-54e2-8f69-9bad6893bbd6", "target_ref": "malware--9ff992ee-9f41-5739-a5d1-ffb624df0c79" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad66d124-d714-5f2f-9c95-059053249c1b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "The Gentlemen / MD5 093f63c3a11f", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: primary_sample_identity\nMatching: exact_hash\nRansom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '093f63c3a11f9ff01de82f3bbf27be17']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/" }, { "source_name": "Public research and attribution", "url": "https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8820ec27-13c3-5414-84ab-0a41bae30444", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--ad66d124-d714-5f2f-9c95-059053249c1b", "target_ref": "malware--9ff992ee-9f41-5739-a5d1-ffb624df0c79" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c7badbcf-11bb-5855-95b5-a6b985627ef1", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook / SHA256 df3f034df512", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: derived_sample_identity\nMatching: exact_hash\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = 'df3f034df512cc5e903d40af015b8d92569e02ce168c34b7e126057ebd0a8a77']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de09a1ce-45ab-577a-af16-ebbfe929f834", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--c7badbcf-11bb-5855-95b5-a6b985627ef1", "target_ref": "malware--e92ea0ca-d905-5870-9410-4c7a86057b8f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5f60aa20-c14a-5abf-b51b-864ebd43e632", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook / SHA1 ebcd20d46b40", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: derived_sample_identity\nMatching: exact_hash\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'ebcd20d46b40734a03e645779875f1fe87882442']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a76034a-b56e-5fcc-b0c5-c2bae4434712", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--5f60aa20-c14a-5abf-b51b-864ebd43e632", "target_ref": "malware--e92ea0ca-d905-5870-9410-4c7a86057b8f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--079c5be6-94b8-5ec5-872b-90f8689e92c2", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook / MD5 4f244724e3ac", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: derived_sample_identity\nMatching: exact_hash\nWorkbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '4f244724e3ac2aae8d39f72e911a9a22']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df15a559-b63c-54be-b31d-c619294517e7", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--079c5be6-94b8-5ec5-872b-90f8689e92c2", "target_ref": "malware--e92ea0ca-d905-5870-9410-4c7a86057b8f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--af8abf45-dc20-52be-9575-dbc279e769d8", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / SHA256 2e81945ba271", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: derived_sample_identity\nMatching: exact_hash\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--152e5aaa-a070-5a4e-a01f-7dcc13d9d70e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--af8abf45-dc20-52be-9575-dbc279e769d8", "target_ref": "malware--043f648a-f5a6-5068-b1fd-61bd9bef8321" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0d852d0a-e936-58a8-b996-ba37aebf28cd", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / SHA1 f7ce179447d9", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: derived_sample_identity\nMatching: exact_hash\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = 'f7ce179447d9693adb10341726989b3b016d4360']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9baf1635-1ce9-51f1-b5f6-312bd3e23984", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--0d852d0a-e936-58a8-b996-ba37aebf28cd", "target_ref": "malware--043f648a-f5a6-5068-b1fd-61bd9bef8321" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5fc76685-f8c7-57f9-a437-68687c42785c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / MD5 cb040464587c", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: derived_sample_identity\nMatching: exact_hash\nMatch the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = 'cb040464587c7901926169d8e046fad8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--945ee18b-f79f-5039-9ffe-087f67ff3715", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--5fc76685-f8c7-57f9-a437-68687c42785c", "target_ref": "malware--043f648a-f5a6-5068-b1fd-61bd9bef8321" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--823f1f63-d1ef-57f2-a803-370bee571f60", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens / SHA256 7ca011030bdb", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: alternative_sample_identity\nMatching: exact_hash\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-256' = '7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03252477-ff0a-598c-8129-d3a800484ce8", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--823f1f63-d1ef-57f2-a803-370bee571f60", "target_ref": "malware--47c27712-1816-58ca-856c-4bf7cd81e826" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d4c5ae5-4b97-55da-a679-5c34e41ec90f", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens / SHA1 87596edc5717", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: alternative_sample_identity\nMatching: exact_hash\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'SHA-1' = '87596edc57173f151068404152eb50212c768c96']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb385cb6-ef8a-5afd-9a7a-9af86d399d7e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--5d4c5ae5-4b97-55da-a679-5c34e41ec90f", "target_ref": "malware--47c27712-1816-58ca-856c-4bf7cd81e826" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74044e28-c979-5d4a-87aa-1d5df0b9421f", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens / MD5 73c940e6cb2f", "description": "Local hash recomputation; malicious classification bounded by the case evidence and catalog label\nRole: alternative_sample_identity\nMatching: exact_hash\nThe completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[file:hashes.'MD5' = '73c940e6cb2ff49f8e8c145524c41fd8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 70, "labels": [ "retrospective-hunt", "no-automatic-blocking", "verified_file_identity" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0bbba6a-7651-5ef2-ab81-6893ccbc4de0", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--74044e28-c979-5d4a-87aa-1d5df0b9421f", "target_ref": "malware--47c27712-1816-58ca-856c-4bf7cd81e826" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6b76ce52-5edf-5c12-bdca-e699c4b1442a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / IPV4-ADDR 213[.]145[.]86[.]112", "description": "Literal bytes independently verified; data flow described by Caronte\nRole: configured_https_server\nMatching: destination_and_port\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '213.145.86.112' AND network-traffic:dst_port = 443]", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05cda647-064a-5f51-b97f-1b3532646c97", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--6b76ce52-5edf-5c12-bdca-e699c4b1442a", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9a766e84-4e72-5672-84a4-1df08c518828", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / URL hxxps://213[.]145[.]86[.]112/t/pixel[.]gif", "description": "Host and path literals independently verified in the acquired script; use described by the retained Caronte report\nRole: configured_beacon_path\nMatching: url_path_with_optional_query\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value MATCHES '^https://213\\\\.145\\\\.86\\\\.112/t/pixel\\\\.gif(\\\\?.*)?$']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7a7267e5-dea7-5af2-b76b-3b3f20424a07", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--9a766e84-4e72-5672-84a4-1df08c518828", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d2e535f9-f518-529c-9298-da69a6a4cd57", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / URL hxxps://213[.]145[.]86[.]112/cdn/chunks/polyfill-7e2b[.]min[.]js", "description": "Host and path literals independently verified in the acquired script; use described by the retained Caronte report\nRole: configured_stage_download\nMatching: url_path_with_optional_query\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value MATCHES '^https://213\\\\.145\\\\.86\\\\.112/cdn/chunks/polyfill\\\\-7e2b\\\\.min\\\\.js(\\\\?.*)?$']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7f1a9c1c-50d5-5201-b10a-04d8cd0ab99b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--d2e535f9-f518-529c-9298-da69a6a4cd57", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--beb1f40d-330f-5172-a1b3-78e7fb60af37", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / URL hxxps://213[.]145[.]86[.]112/cdn/chunks/vendor-9f3a1c[.]min[.]js", "description": "Host and path literals independently verified in the acquired script; use described by the retained Caronte report\nRole: configured_stage_download\nMatching: url_path_with_optional_query\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value MATCHES '^https://213\\\\.145\\\\.86\\\\.112/cdn/chunks/vendor\\\\-9f3a1c\\\\.min\\\\.js(\\\\?.*)?$']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff0259b6-3013-545d-a5c5-eaab4ef057e9", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--beb1f40d-330f-5172-a1b3-78e7fb60af37", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--38047a3b-470c-50a2-9814-e4ad72baa98d", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell / URL hxxps://213[.]145[.]86[.]112/t/event", "description": "Host and path literals independently verified in the acquired script; use described by the retained Caronte report\nRole: configured_result_submission\nMatching: url_path_with_optional_query\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value MATCHES '^https://213\\\\.145\\\\.86\\\\.112/t/event(\\\\?.*)?$']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28238837-5170-5ad0-a1f3-b85415332aeb", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--38047a3b-470c-50a2-9814-e4ad72baa98d", "target_ref": "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74549995-4eaa-5539-b813-9e8c42202eb4", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Prime ReverseShell / IPV4-ADDR 89[.]44[.]9[.]186", "description": "Caronte traced decoded value to TcpClient\nRole: configured_reverse_shell_destination\nMatching: destination_and_port\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.44.9.186' AND network-traffic:dst_port = 3240]", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 80, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a8bcc479-c735-5779-a4e7-cb83b347f7fe", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--74549995-4eaa-5539-b813-9e8c42202eb4", "target_ref": "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--485911df-cb97-57cb-af11-457ca1db9278", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gamaredon / UltraVNC package / DOMAIN-NAME seemsurprise[.]com", "description": "Caronte recovered launcher connection argument\nRole: configured_reverse_vnc_destination\nMatching: destination_and_port\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'seemsurprise.com' AND network-traffic:dst_port = 443]", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 80, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35201da3-e531-5231-bab8-e8731043a611", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--485911df-cb97-57cb-af11-457ca1db9278", "target_ref": "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c0afd58b-bf00-5420-b9d7-3ef3bea412d6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / URL hxxps://webhook[.]site/82911ae6-ea27-4996-a664-2322e89da9ae", "description": "Locally reconstructed batch; independently analyzed by Caronte\nRole: configured_task_retrieval\nMatching: exact_url\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted. Match the exact webhook URL and its tasking or result-submission role; the hosting service is legitimate.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value = 'https://webhook.site/82911ae6-ea27-4996-a664-2322e89da9ae']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4c2d3cf-5e06-5215-89a2-b223aa1a8d86", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--c0afd58b-bf00-5420-b9d7-3ef3bea412d6", "target_ref": "malware--693e117f-6c6c-53bf-937e-b9d5457d2643" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f3d11331-49c1-5ed4-98b7-54081240c003", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE / URL hxxps://webhook[.]site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee", "description": "HTML form action in statically extracted original VBA\nRole: configured_result_submission\nMatching: exact_url\nCorrelate the exact value, destination port, host process and observation time. Current endpoint activity is not asserted. Match the exact webhook URL and its tasking or result-submission role; the hosting service is legitimate.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value = 'https://webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-08T21:21:50.696Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0aacbc65-2054-532b-b4ab-d2080810dff9", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--f3d11331-49c1-5ed4-98b7-54081240c003", "target_ref": "malware--693e117f-6c6c-53bf-937e-b9d5457d2643" }, { "type": "note", "spec_version": "2.1", "id": "note--cbac5e4d-d868-5f08-94b6-c1810d93df7c", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Gorbag / delivery workbook: evidence and contextual artifacts", "content": "An XLSM delivery workbook reconstructs a PE payload that collects browser data, OpenVPN configuration and documents, with Telegram Bot API upload logic.\n\nReverse-engineering findings:\nThe recovered PE collects Chrome and Edge Login Data, Cookies and Local State files, Firefox profile data, and OpenVPN configuration. Its document sweep covers 21 extensions, including Office documents, archives, email files and images.\n\nThe upload routine at `FUN_1400026c0` builds `https://api.telegram.org/bot%s/sendDocument` and uses libcurl multipart form data with `chat_id` and `document` fields. The decoder at `FUN_1400014b0` applies two layers of XOR to configuration, with constants including `GY8RPV3HOMKGNSWMFLHP` and `4543geqsccegrth`.\n\nThe executable also transforms files in place with a derived XOR key, creates a self-deleting batch component, checks for debuggers and resolves APIs through LoadLibraryW and GetProcAddress. The Telegram URL contains a bot-token placeholder, so the feed records it as a service template rather than a unique attacker endpoint.\n\nEvidence scope: Workbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nfile_path | %PROGRAMDATA%\\audiolib\\audiolib | correlation_artifact | Statically recovered artifact; correlate with the specimen and host events.\nurl | https://api.telegram.org/bot%s/sendDocument | legitimate_service_url_template | Telegram Bot API URL template. The bot-token placeholder is unresolved in this value; retain as service context, not an operational endpoint indicator.\nother | GY8RPV3HOMKGNSWMFLHP | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | 4543geqsccegrth | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | HYHEBWVUFVWEFYUWEUBCYVBWEVFEGWYTFVT3434 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | AUN07ZRXZMH703Y | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | EFEVCD38GRS | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | O6RSIWYCF74T4FY | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Google\\Chrome\\User Data\\Default\\Network\\Cookies | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Google\\Chrome\\User Data\\Default\\Login Data | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Microsoft\\Edge\\User Data\\Default\\Network\\Cookies | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Microsoft\\Edge\\User Data\\Default\\Login Data | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Mozilla\\Firefox\\Profiles | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Microsoft\\Edge\\User Data\\Local State | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | Google\\Chrome\\User Data\\Local State | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | OpenVPN\\config | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | release | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--ed09db9e-7e4f-532b-8fff-3541f60e1aeb", "file--e5134e9d-08eb-55a0-9756-adc256dd93dc", "malware--c2924da1-4b83-590b-af42-8c9b118dfbc2", "malware--e92ea0ca-d905-5870-9410-4c7a86057b8f" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--d5f8cf82-36da-53fa-80eb-3bc685dc39b3", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gorbag / delivery workbook — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "An XLSM delivery workbook reconstructs a PE payload that collects browser data, OpenVPN configuration and documents, with Telegram Bot API upload logic.\n\nThe recovered PE collects Chrome and Edge Login Data, Cookies and Local State files, Firefox profile data, and OpenVPN configuration. Its document sweep covers 21 extensions, including Office documents, archives, email files and images.\n\nThe upload routine at `FUN_1400026c0` builds `https://api.telegram.org/bot%s/sendDocument` and uses libcurl multipart form data with `chat_id` and `document` fields. The decoder at `FUN_1400014b0` applies two layers of XOR to configuration, with constants including `GY8RPV3HOMKGNSWMFLHP` and `4543geqsccegrth`.\n\nThe executable also transforms files in place with a derived XOR key, creates a self-deleting batch component, checks for debuggers and resolves APIs through LoadLibraryW and GetProcAddress. The Telegram URL contains a bot-token placeholder, so the feed records it as a service template rather than a unique attacker endpoint.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Workbook delivery and recovered-PE behavior refer to distinct linked specimens. The Telegram URL contains a token placeholder and identifies a shared service, not a unique attacker-controlled URL. The saved workbook response is truncated. The derived PE export excludes 16 certificate OIDs misclassified as IPs and restores the file score from 25 to its base score of 51. Telegram sendDocument is an exfiltration path; no command-receiving path was found. Review adjustments preserve the original classifications and provenance.", "object_refs": [ "file--ed09db9e-7e4f-532b-8fff-3541f60e1aeb", "file--e5134e9d-08eb-55a0-9756-adc256dd93dc", "malware--c2924da1-4b83-590b-af42-8c9b118dfbc2", "malware--e92ea0ca-d905-5870-9410-4c7a86057b8f", "indicator--e982b5ab-fd2b-5d7b-858b-f65ba6766c5b", "indicator--338e1ae2-0cf0-5392-84b3-d27fee129c35", "indicator--fb2cf0aa-9609-53cc-98c1-6a159cc0c4d3", "indicator--c7badbcf-11bb-5855-95b5-a6b985627ef1", "indicator--5f60aa20-c14a-5abf-b51b-864ebd43e632", "indicator--079c5be6-94b8-5ec5-872b-90f8689e92c2", "note--cbac5e4d-d868-5f08-94b6-c1810d93df7c" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/9ce0f41d6e575aca81d290b3d0b89b011da4f9b87276b27d1c7de81695d4c927/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--3d688c1e-8dd2-5e90-8194-829d017cdc79", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "HOOKEDGE: evidence and contextual artifacts", "content": "Office delivery document and reconstructed batch client using an off-screen Edge window for task retrieval and a separate webhook path for result submission.\n\nReverse-engineering findings:\nThe recovered macro installs a scheduled task with a 61-minute interval and writes the command-loop components. The reconstructed batch launches Microsoft Edge in a 1×1 window at off-screen coordinates 10000,10000, with an inline base64 HTML document that redirects to the tasking webhook.\n\nAfter a 20-second wait, the script assembles downloaded task material into a command file, executes it with `call`, and captures standard output and error. The original macro supplies separate HTML wrappers and the result-submission webhook. Task retrieval and result submission therefore have distinct URLs and roles.\n\nOutput filenames are generated from `%random%` expressions. The command loop also terminates processes and removes files after preparing the results.\n\nEvidence scope: Match the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\ndomain | webhook.site | legitimate_shared_service | Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\nfile_path | %userprofile%\\Downloads\\*.9ae | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nfile_path | %userprofile%\\%random%%random%%random%.9ae.cmd | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nfile_path | %userprofile%\\82911ae6-ea27-4996-a664-2322e89da9ae.htm | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nfile_path | %userprofile%\\82911ae6-ea27-4996-a664-2322e89da9ae.xhtml | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nprocess_name | msedge.exe | context_only | Context artifact; correlate with specimen and host evidence.\nsha256 | 7520dd2043f62335a65211debfc991658f7777f699c65a0497e669bb8ddbd7fd | uncharacterised_retrieved_artifact | Child-file hash reported in the graph; the child content and maliciousness are not independently confirmed. Context only.\nscheduled_task_interval | PT61M | correlation_artifact | The macro defines a 61-minute task interval. This is specimen-specific, rather than a requirement for detecting the family.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--4a984f0d-2dcf-54fa-b01b-ac7cfc45b8d9", "file--ef480ddf-fecf-5802-ae71-8338344d1214", "malware--693e117f-6c6c-53bf-937e-b9d5457d2643", "malware--043f648a-f5a6-5068-b1fd-61bd9bef8321" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--a8d9b2ce-c33b-51e6-902e-ebbeb1986ee4", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "HOOKEDGE — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "Office delivery document and reconstructed batch client using an off-screen Edge window for task retrieval and a separate webhook path for result submission.\n\nThe recovered macro installs a scheduled task with a 61-minute interval and writes the command-loop components. The reconstructed batch launches Microsoft Edge in a 1×1 window at off-screen coordinates 10000,10000, with an inline base64 HTML document that redirects to the tasking webhook.\n\nAfter a 20-second wait, the script assembles downloaded task material into a command file, executes it with `call`, and captures standard output and error. The original macro supplies separate HTML wrappers and the result-submission webhook. Task retrieval and result submission therefore have distinct URLs and roles.\n\nOutput filenames are generated from `%random%` expressions. The command loop also terminates processes and removes files after preparing the results.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Match the exact tasking and submission URLs; webhook.site itself is a legitimate service. Commands delivered by a remote server require their own captured artifacts and execution context.", "object_refs": [ "file--4a984f0d-2dcf-54fa-b01b-ac7cfc45b8d9", "file--ef480ddf-fecf-5802-ae71-8338344d1214", "malware--693e117f-6c6c-53bf-937e-b9d5457d2643", "malware--043f648a-f5a6-5068-b1fd-61bd9bef8321", "indicator--26e4cc63-ca28-5af8-a505-5670ff05dc86", "indicator--28c78462-3110-5522-a109-badf8885c51c", "indicator--55e39c16-8d3e-54a6-85cd-2c4c017172ef", "indicator--af8abf45-dc20-52be-9575-dbc279e769d8", "indicator--0d852d0a-e936-58a8-b996-ba37aebf28cd", "indicator--5fc76685-f8c7-57f9-a437-68687c42785c", "indicator--c0afd58b-bf00-5420-b9d7-3ef3bea412d6", "indicator--f3d11331-49c1-5ed4-98b7-54081240c003", "note--3d688c1e-8dd2-5e90-8194-829d017cdc79" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495/" }, { "source_name": "Public research and attribution", "url": "https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--9b54a16d-e3e1-5fa2-aaf5-22ba354b430d", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Covenant-tagged proxy loader: evidence and contextual artifacts", "content": "An IDStore.dll proxy loader uses the resolvefree mutex and a HIDE container in icon.png, deriving an AES key with PBKDF2 before calling the recovered stage in memory.\n\nReverse-engineering findings:\nThe DLL resolves the genuine idstore.dll and forwards DllCanUnloadNow and DllGetClassObject. Its activation logic checks the host process, uses the `resolvefree` mutex, and reads `%appdata%\\Microsoft\\Network\\Cache\\icon.png`.\n\nThe container uses the `HIDE` marker and version 1. Caronte traces PBKDF2-HMAC-SHA256 with 20,000 iterations and AES-CBC decryption, followed by PKCS#7 unpadding and allocation of executable memory through a resolved NtAllocateVirtualMemory function. The loader retries on a 15-second cycle.\n\nThe passphrase `838645f4bab7458fb130c7120a500982` is independently verified in this DLL after XOR-0x68 decoding and also appears in PixyNetLoader. The acquired artifact is the proxy loader; icon.png is the separately staged payload container.\n\nEvidence scope: The acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nfile_path | %appdata%\\Microsoft\\Network\\Cache\\icon.png | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nmutex | resolvefree | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nprocess_name | regsvr32.exe | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | explorer.exe | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | IDStore.dll | context_only | Context artifact; correlate with specimen and host evidence.\nother | 838645f4bab7458fb130c7120a500982 | embedded_constant | Cryptographic or configuration constant reported in code; this is not a file hash.\nother | HIDE | context_only | Context artifact; correlate with specimen and host evidence.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--12a374a1-e2af-577d-8ede-e78885f6d173", "malware--d0d67e70-9d0e-50f8-8171-fab51814fc7f" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--e6dbdf49-7f52-555e-bf69-52115055d48e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Covenant-tagged proxy loader — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "An IDStore.dll proxy loader uses the resolvefree mutex and a HIDE container in icon.png, deriving an AES key with PBKDF2 before calling the recovered stage in memory.\n\nThe DLL resolves the genuine idstore.dll and forwards DllCanUnloadNow and DllGetClassObject. Its activation logic checks the host process, uses the `resolvefree` mutex, and reads `%appdata%\\Microsoft\\Network\\Cache\\icon.png`.\n\nThe container uses the `HIDE` marker and version 1. Caronte traces PBKDF2-HMAC-SHA256 with 20,000 iterations and AES-CBC decryption, followed by PKCS#7 unpadding and allocation of executable memory through a resolved NtAllocateVirtualMemory function. The loader retries on a 15-second cycle.\n\nThe passphrase `838645f4bab7458fb130c7120a500982` is independently verified in this DLL after XOR-0x68 decoding and also appears in PixyNetLoader. The acquired artifact is the proxy loader; icon.png is the separately staged payload container.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The acquired artifact is the proxy loader; the externally staged icon.png represents a separate execution stage.", "object_refs": [ "file--12a374a1-e2af-577d-8ede-e78885f6d173", "malware--d0d67e70-9d0e-50f8-8171-fab51814fc7f", "indicator--04ae9f33-caf4-5c29-8238-601c522567ed", "indicator--ec79c2b0-8f9c-555b-a1d2-7146c3825327", "indicator--df4ba604-84e7-5e7d-a18e-548efd82c72b", "note--9b54a16d-e3e1-5fa2-aaf5-22ba354b430d" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c03f09eda8c19fa5c26854a81b01069454faf66e78844f61d301bebda4a09b86/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--a96704ab-24fd-5d9b-9657-8f22b55dad84", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Matchboil: evidence and contextual artifacts", "content": "A protected .NET loader resolves native APIs dynamically, handles encrypted resources and invokes assemblies in memory through a flattened managed-code control flow.\n\nReverse-engineering findings:\nCaronte reconstructs string-split resolution of VirtualAlloc, VirtualProtect, WriteProcessMemory, OpenProcess and CloseHandle, binding the resolved functions to delegates with Marshal.GetDelegateForFunctionPointer.\n\nThe loader handles four encrypted resources, hooks AppDomain.ResourceResolve and combines Rijndael/AES, TripleDES, MD5 and decompression routines with Assembly.Load, Activator.CreateInstance and assembly-entry-point invocation. The largest resource is 215,580 bytes.\n\nCaronte recovers an AES-256 key/IV pair for one routine, native trampolines and RSA/MD5 anti-tamper material. The embedded stage derives its own configuration at runtime.\n\nEvidence scope: The reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nprocess_name | Yhosh.exe | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\ndebug_guid | 33049a21-567a-4652-baa1-05ca846616e1 | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nother | 086c61a26785db09c1f87ce1eb106d649022b9889b9d5a45c6719fdc988799d0 | embedded_constant | Cryptographic or configuration constant reported in code; this is not a file hash.\nother | 583f64bd6f32ca771cb7cb1a95aa8a12 | embedded_constant | Cryptographic or configuration constant reported in code; this is not a file hash.\nother | 5171A332-8373-4159-B89B-05F3AE0920B8 | context_only | Context artifact; correlate with specimen and host evidence.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--7d33e64a-c97c-5e91-88ca-79e6b7f68cdd", "malware--7fb45087-f8ab-57ba-9907-4088f40e01df" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--c4f20aee-eacf-5653-b8d0-7bcf74f77b23", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Matchboil — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A protected .NET loader resolves native APIs dynamically, handles encrypted resources and invokes assemblies in memory through a flattened managed-code control flow.\n\nCaronte reconstructs string-split resolution of VirtualAlloc, VirtualProtect, WriteProcessMemory, OpenProcess and CloseHandle, binding the resolved functions to delegates with Marshal.GetDelegateForFunctionPointer.\n\nThe loader handles four encrypted resources, hooks AppDomain.ResourceResolve and combines Rijndael/AES, TripleDES, MD5 and decompression routines with Assembly.Load, Activator.CreateInstance and assembly-entry-point invocation. The largest resource is 215,580 bytes.\n\nCaronte recovers an AES-256 key/IV pair for one routine, native trampolines and RSA/MD5 anti-tamper material. The embedded stage derives its own configuration at runtime.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The reported key/IV pair belongs to one loader routine and should not be treated as a universal payload-decryption key. MATCHBOIL is the catalog label. Caronte assigns no family, the inspected assembly references no networking APIs, and the embedded stage was not extracted. These findings do not confirm MATCHBOIL or its downloader behaviour.", "object_refs": [ "file--7d33e64a-c97c-5e91-88ca-79e6b7f68cdd", "malware--7fb45087-f8ab-57ba-9907-4088f40e01df", "indicator--d1b8c64d-a91b-589f-b4b7-f842283e0ed6", "indicator--aeef5bbe-2ff6-5d84-a990-8666309b8dc2", "indicator--eea5c0b6-cb0f-585b-b016-9f2915c90b44", "note--a96704ab-24fd-5d9b-9657-8f22b55dad84" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--af07c7c5-e337-5bec-9f07-852a2eada9f3", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Gamaredon / UltraVNC package: evidence and contextual artifacts", "content": "A weaponized 7-Zip SFX package deploys a renamed UltraVNC server and configures an outbound reverse-VNC connection to seemsurprise.com:443.\n\nReverse-engineering findings:\nThe SFX configuration selects silent extraction to `%APPDATA%\\Adobe` and hidden-console execution of 68083.cmd. The launcher opens a decoy document, copies the disguised archive member FwYmY8YvYxYMYVYi.ini to explorerr.exe, then starts the renamed UltraVNC server.\n\nThe reverse-VNC command uses `-autoreconnect -connect seemsurprise.com:443` and a MAC-address-derived client identifier. UltraVNC.ini specifies a local listening port of 5612; the package includes an RC4 DSM plugin and key file.\n\nThe launcher also cleans up the staging directory. A password configuration is bundled with the remote-access files.\n\nEvidence scope: UltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nfile_path | %APPDATA%\\Adobe | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\Adobe\\68083.cmd | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nprocess_name | explorerr.exe | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nfile_path | FwYmY8YvYxYMYVYi.ini | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nfile_path | UltraVNC.ini | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | rc4.key | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | MSRC4Plugin_for_sc.dsm | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | 1.docx | context_only | Context artifact; correlate with specimen and host evidence.\nmutex | WinVNC_Win32_Instance_Mutex | context_only | Context artifact; correlate with specimen and host evidence.\nother | A7F8FC867315B7FF5F | context_only | Context artifact; correlate with specimen and host evidence.\nother | 7ZSfx%03x.cmd | context_only | Context artifact; correlate with specimen and host evidence.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--3185132a-30ee-5cae-ac9b-52dbd561b24c", "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--903f5457-2c85-599d-a278-1ee3ba379780", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Gamaredon / UltraVNC package — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A weaponized 7-Zip SFX package deploys a renamed UltraVNC server and configures an outbound reverse-VNC connection to seemsurprise.com:443.\n\nThe SFX configuration selects silent extraction to `%APPDATA%\\Adobe` and hidden-console execution of 68083.cmd. The launcher opens a decoy document, copies the disguised archive member FwYmY8YvYxYMYVYi.ini to explorerr.exe, then starts the renamed UltraVNC server.\n\nThe reverse-VNC command uses `-autoreconnect -connect seemsurprise.com:443` and a MAC-address-derived client identifier. UltraVNC.ini specifies a local listening port of 5612; the package includes an RC4 DSM plugin and key file.\n\nThe launcher also cleans up the staging directory. A password configuration is bundled with the remote-access files.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: UltraVNC is legitimate software; the delivery chain and remote-connection configuration establish the relevant case context.", "object_refs": [ "file--3185132a-30ee-5cae-ac9b-52dbd561b24c", "malware--48e26f9f-78f9-55dd-8bbc-0444dcb1d6c9", "indicator--01ae6184-9a47-5c35-9617-4147960d746a", "indicator--40e29947-5e09-56a3-87b7-9b4069f7009f", "indicator--f61a7815-fde8-55e8-aace-8a49cef60b7b", "indicator--485911df-cb97-57cb-af11-457ca1db9278", "note--af07c7c5-e337-5bec-9f07-852a2eada9f3" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/708eb15888514e4675cb7501abcccde0ad2df369e518730d96594ff77d67fa73/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--13c66253-a319-5ecb-b79c-34fe2f4a4a49", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "CornFlake catalog specimen: evidence and contextual artifacts", "content": "The CornFlake catalog specimen is described by Caronte as a Go RemusStealer-style infostealer/RAT, with browser and SSH collection, surveillance features and a configurable WebSocket channel.\n\nReverse-engineering findings:\nThe CornFlake name follows the catalog and Microsoft hash match. Caronte classifies the code as a RemusStealer-style Go infostealer/RAT. Collection routines target Chromium and Firefox browsers, SSH keys, RDP server lists, Office recent-file data and USB history.\n\nThe report traces screenshot, webcam and microphone capture, keystroke and clipboard monitoring, document watching and USB-file collection. Persistence paths include registry Run keys, a scheduled task presented as Windows Update Setup and a service presented as Cloud Sync Service, with svchost32.exe as a process name.\n\nThe connection chain runs from `connectLoop` at 0x140311160 through `serverList` and `tryDNSFallback`. Defaults are localhost:9000 and 127.0.0.1:9100. DNS TXT lookup parses `s=` host/port records from a domain supplied at runtime. The feed records these loopback defaults and the lookup mechanism as context; they do not supply an external command-server address.\n\nEvidence scope: CornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nip | 127.0.0.1:9100 | loopback_default | Localhost default in serverList. This identifies local configuration, not an external command server.\nip | localhost:9000 | loopback_default | Localhost default in serverList. This identifies local configuration, not an external command server.\nprocess_name | svchost32.exe | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nprocess_name | powershell.exe | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nprocess_name | cmd.exe | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nfile_path | cookies.sqlite | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | key4.db | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | profiles.ini | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | _manifest.json | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | .ssh\\id_rsa | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | .ssh\\id_dsa | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | .ssh\\id_ed25519 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nregistry_key | HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nmutex | Single-instance mutex (runtime-generated name) | behavior_description | Description of runtime mutex generation; no fixed mutex name is supplied.\nservice | Cloud Sync Service | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nscheduled_task | Windows Update Setup (masqueraded name) | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | amsi.dll | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | AmsiScanBuffer | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--a0db5f14-9729-5d6a-8a07-bfd1ca212e9e", "malware--08dc59e1-c708-5fd9-87ef-d7d991e755b6" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--71a629dd-2971-591d-80a7-0b1036d6c13a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "CornFlake catalog specimen — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "The CornFlake catalog specimen is described by Caronte as a Go RemusStealer-style infostealer/RAT, with browser and SSH collection, surveillance features and a configurable WebSocket channel.\n\nThe CornFlake name follows the catalog and Microsoft hash match. Caronte classifies the code as a RemusStealer-style Go infostealer/RAT. Collection routines target Chromium and Firefox browsers, SSH keys, RDP server lists, Office recent-file data and USB history.\n\nThe report traces screenshot, webcam and microphone capture, keystroke and clipboard monitoring, document watching and USB-file collection. Persistence paths include registry Run keys, a scheduled task presented as Windows Update Setup and a service presented as Cloud Sync Service, with svchost32.exe as a process name.\n\nThe connection chain runs from `connectLoop` at 0x140311160 through `serverList` and `tryDNSFallback`. Defaults are localhost:9000 and 127.0.0.1:9100. DNS TXT lookup parses `s=` host/port records from a domain supplied at runtime. The feed records these loopback defaults and the lookup mechanism as context; they do not supply an external command-server address.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: CornFlake is the catalog/published-indicator context; RemusStealer is the updated report's implementation assessment. localhost and 127.0.0.1 are local defaults, not external attacker infrastructure.", "object_refs": [ "file--a0db5f14-9729-5d6a-8a07-bfd1ca212e9e", "malware--08dc59e1-c708-5fd9-87ef-d7d991e755b6", "indicator--70ce193e-5e7b-5ba3-a2b7-613dc93e9e11", "indicator--f14176b8-e5ed-59d5-859c-ca3d10b88f93", "indicator--4d914eb8-85b1-54c3-9eef-50b867675352", "note--13c66253-a319-5ecb-b79c-34fe2f4a4a49" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--b60d3753-ab1b-5292-bd03-06b0bf104441", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "ChocoShell: evidence and contextual artifacts", "content": "A PowerShell infostealer collects browser credentials and cookies, Microsoft token-cache data and WiFi credentials, with a configured HTTPS upload workflow.\n\nReverse-engineering findings:\nThe script includes an AMSI reflection bypass, a WinHTTP COM wrapper, a timing check and elevation paths involving SilentCleanup, wsreset.exe and sdclt.exe. Its elevated stub retrieves a second-stage resource from the configured HTTPS server.\n\nCollection includes Chromium-family App-Bound Encryption key handling, DPAPI and NCrypt/AES-GCM operations, VSS-assisted database copies, Chrome DevTools Protocol cookie access, Firefox-family cookie stores, Microsoft Token Broker .tbres files and netsh-based WiFi credential collection.\n\nThe upload path gzip-compresses and base64-encodes the results, then submits JSON to `/t/event`. The feed preserves the configured server, beacon, download and upload paths as distinct indicators and includes their documented query-matching rules.\n\nEvidence scope: The indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nregistry_key | HKCU:\\Environment\\windir | context_only | Context artifact; correlate with specimen and host evidence.\nregistry_key | HKCU:\\Software\\Classes\\AppX3xxs313wwkfjhythsb8q46xdsvu8p2v\\Shell\\open\\command | context_only | Context artifact; correlate with specimen and host evidence.\nregistry_key | HKCU:\\Software\\Classes\\Folder\\shell\\open\\command | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %LOCALAPPDATA%\\Google\\Chrome\\User Data | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\Opera Software\\Opera Stable | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\Opera Software\\Opera GX Stable | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %LOCALAPPDATA%\\Vivaldi\\User Data | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\Mozilla\\Firefox\\Profiles | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\Waterfox\\Profiles | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %LOCALAPPDATA%\\LibreWolf\\Profiles | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\Floorp\\Profiles | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %APPDATA%\\zen\\Profiles | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | ConfigurationRemotingServer | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | wsreset.exe | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | sdclt.exe | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | taskkill.exe | context_only | Context artifact; correlate with specimen and host evidence.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--8905028a-5645-50b3-9b93-0544448bc9cb", "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--3af21919-0a7f-5806-a32e-083cc043789a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "ChocoShell — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A PowerShell infostealer collects browser credentials and cookies, Microsoft token-cache data and WiFi credentials, with a configured HTTPS upload workflow.\n\nThe script includes an AMSI reflection bypass, a WinHTTP COM wrapper, a timing check and elevation paths involving SilentCleanup, wsreset.exe and sdclt.exe. Its elevated stub retrieves a second-stage resource from the configured HTTPS server.\n\nCollection includes Chromium-family App-Bound Encryption key handling, DPAPI and NCrypt/AES-GCM operations, VSS-assisted database copies, Chrome DevTools Protocol cookie access, Firefox-family cookie stores, Microsoft Token Broker .tbres files and netsh-based WiFi credential collection.\n\nThe upload path gzip-compresses and base64-encodes the results, then submits JSON to `/t/event`. The feed preserves the configured server, beacon, download and upload paths as distinct indicators and includes their documented query-matching rules.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The indicators describe recovered configuration and code paths; incident-level exfiltration is established from the affected environment's telemetry.", "object_refs": [ "file--8905028a-5645-50b3-9b93-0544448bc9cb", "malware--2b9d21b4-ef35-5378-b4fa-d7fda55031fc", "indicator--3214275b-b41b-52db-a5fa-c5852520a36c", "indicator--41e84d06-4b86-5c30-86be-cffa06510f3d", "indicator--f7fd1d3c-874f-59ca-95b8-7e77528d7725", "indicator--6b76ce52-5edf-5c12-bdca-e699c4b1442a", "indicator--9a766e84-4e72-5672-84a4-1df08c518828", "indicator--d2e535f9-f518-529c-9298-da69a6a4cd57", "indicator--beb1f40d-330f-5172-a1b3-78e7fb60af37", "indicator--38047a3b-470c-50a2-9814-e4ad72baa98d", "note--b60d3753-ab1b-5292-bd03-06b0bf104441" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c/" }, { "source_name": "Public research and attribution", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--c9f499b2-b3b8-50eb-8fd6-db8e1abcd9eb", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Prime ReverseShell: evidence and contextual artifacts", "content": "A PS2EXE-style .NET host loads nnnnrth.ps1, waits about eight minutes and opens a TCP reverse shell to 89.44.9.186:3240.\n\nReverse-engineering findings:\nThe managed entry point reads the manifest resource nnnnrth.ps1 and feeds it into a PowerShell runspace. The script delays execution with a Get-Date/Start-Sleep loop before reconstructing the destination from `89n44n9n186_3240`.\n\nA System.Net.Sockets.TcpClient connects to 89.44.9.186 on port 3240. A StreamReader loop passes received lines to Invoke-Expression and writes output plus the working directory back with HTTP-like status and JSON framing.\n\nThe literal `Host: ipinfo.io` is part of that framing. Other embedded addresses have different, unused roles in the traced connection path. The feed keeps the configured destination separate from those contextual values.\n\nEvidence scope: Use the destination and port from the TcpClient path; other address literals and the Host header have separate roles.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nip | 196.241.202.107 | unused_or_decoy_literal | Literal not linked to the traced TcpClient destination. The 127.0.0.0/8 range is loopback; retain as context.\nip | 127.53.10.21 | unused_or_decoy_literal | Literal not linked to the traced TcpClient destination. The 127.0.0.0/8 range is loopback; retain as context.\ndomain | ipinfo.io | legitimate_shared_service | Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\nfile_path | nnnnrth.ps1 | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nprocess_name | Windows Telemetry.exe | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--03c4b02b-ac23-5a85-ac26-3ec4c7b9a54b", "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--073e2bce-cbbc-596b-9da1-9b8abefb1261", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Prime ReverseShell — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A PS2EXE-style .NET host loads nnnnrth.ps1, waits about eight minutes and opens a TCP reverse shell to 89.44.9.186:3240.\n\nThe managed entry point reads the manifest resource nnnnrth.ps1 and feeds it into a PowerShell runspace. The script delays execution with a Get-Date/Start-Sleep loop before reconstructing the destination from `89n44n9n186_3240`.\n\nA System.Net.Sockets.TcpClient connects to 89.44.9.186 on port 3240. A StreamReader loop passes received lines to Invoke-Expression and writes output plus the working directory back with HTTP-like status and JSON framing.\n\nThe literal `Host: ipinfo.io` is part of that framing. Other embedded addresses have different, unused roles in the traced connection path. The feed keeps the configured destination separate from those contextual values.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Use the destination and port from the TcpClient path; other address literals and the Host header have separate roles.", "object_refs": [ "file--03c4b02b-ac23-5a85-ac26-3ec4c7b9a54b", "malware--9c08b265-c4af-5d1e-a515-03aafaadd5e3", "indicator--e9d4eb02-a52d-5a96-a026-10a7acb2bcc5", "indicator--20b683a2-b477-5346-8024-93c05936702b", "indicator--0d4e46aa-c046-53dd-b666-0ba4ed637e71", "indicator--74549995-4eaa-5539-b813-9e8c42202eb4", "note--c9f499b2-b3b8-50eb-8fd6-db8e1abcd9eb" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--5f2d2560-9270-591e-b51c-6330d7fe9d90", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "PixyNetLoader: evidence and contextual artifacts", "content": "An EdgeSyncPr.dll proxy loader extracts an encrypted stage from EdgeLogo.png and shares a verified passphrase with the Covenant-tagged DLL.\n\nReverse-engineering findings:\nThe DLL presents itself as EdgeSyncPr.dll, resolves stobject.dll and forwards COM exports. It decodes XOR-0x57 strings, checks regsvr32.exe or explorer.exe as its host, and applies a Sleep-based timing check before the staged execution path.\n\nThe loader reads `%programdata%\\Microsoft\\DeviceSync\\EdgeSync\\EdgeLogo.png`, extracts image bits, derives a key with PBKDF2-HMAC-SHA256 at 20,000 iterations, and applies AES-CBC. The recovered container is checked for `HIDE` and CRC32-related consistency before executable-memory allocation and invocation. The cycle includes a 20-minute sleep.\n\nIts plaintext passphrase matches the independently decoded constant in the Covenant-tagged DLL. API resolution uses an export-table hash walk with seed 0x1E9A and multiplier 0x21. The acquired DLL and its external image container are separate artifacts.\n\nEvidence scope: The technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nfile_path | %programdata%\\Microsoft\\DeviceSync\\EdgeSync\\EdgeLogo.png | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nother | 838645f4bab7458fb130c7120a500982 | embedded_constant | Cryptographic or configuration constant reported in code; this is not a file hash.\nother | HIDE | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | EdgeSyncPr.dll | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\nprocess_name | explorer.exe | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | regsvr32.exe | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | stobject.dll | context_only | Context artifact; correlate with specimen and host evidence.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--505418cd-261d-5904-a181-6aedd958190b", "malware--5da41fbe-da48-54c7-8c0e-56ab5ad47b77" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--f080f8ef-520d-5692-bf37-c5ca48511bb2", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "PixyNetLoader — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "An EdgeSyncPr.dll proxy loader extracts an encrypted stage from EdgeLogo.png and shares a verified passphrase with the Covenant-tagged DLL.\n\nThe DLL presents itself as EdgeSyncPr.dll, resolves stobject.dll and forwards COM exports. It decodes XOR-0x57 strings, checks regsvr32.exe or explorer.exe as its host, and applies a Sleep-based timing check before the staged execution path.\n\nThe loader reads `%programdata%\\Microsoft\\DeviceSync\\EdgeSync\\EdgeLogo.png`, extracts image bits, derives a key with PBKDF2-HMAC-SHA256 at 20,000 iterations, and applies AES-CBC. The recovered container is checked for `HIDE` and CRC32-related consistency before executable-memory allocation and invocation. The cycle includes a 20-minute sleep.\n\nIts plaintext passphrase matches the independently decoded constant in the Covenant-tagged DLL. API resolution uses an export-table hash walk with seed 0x1E9A and multiplier 0x21. The acquired DLL and its external image container are separate artifacts.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The technical correlation is the verified loader passphrase; it does not independently establish a common operator or final payload.", "object_refs": [ "file--505418cd-261d-5904-a181-6aedd958190b", "malware--5da41fbe-da48-54c7-8c0e-56ab5ad47b77", "indicator--a57b6716-0fca-5a19-8d20-13d77fd0e19d", "indicator--7e2684d1-d869-564e-8457-3ff0b216f55e", "indicator--72febc9a-300e-540a-81e1-16ad30fff5fc", "note--5f2d2560-9270-591e-b51c-6330d7fe9d90" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5/" }, { "source_name": "Public research and attribution", "url": "https://www.zscaler.com/de/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--23dbda4a-b7d0-5878-be11-4ddcf96bdc82", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "DynoWiper: evidence and contextual artifacts", "content": "A Windows disk wiper enumerates fixed and removable drives, overwrites file content using a PRNG-generated pattern and performs a subsequent deletion pass.\n\nReverse-engineering findings:\nThe orchestrator seeds a Mersenne Twister using RtlGenRandom, enumerates logical drives and selects fixed and removable volumes. Its directory walk applies an exclusion list that includes Windows and Program Files paths.\n\nFor selected files, it clears attributes and writes a 16-byte buffer at the header and at up to 4,096 PRNG-selected offsets. After five seconds, it recursively deletes files. This overwrite-and-delete sequence implements the wiping behavior.\n\nThe executable contains the build path `C:\\Users\\vagrant\\Documents\\Visual Studio 2013\\Projects\\Source\\Release\\Source.pdb`. Caronte identifies the enumeration and write functions responsible for local file destruction; no command-channel role is assigned.\n\nEvidence scope: The report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\npdb_path | C:\\Users\\vagrant\\Documents\\Visual Studio 2013\\Projects\\Source\\Release\\Source.pdb | context_only | Context artifact; correlate with specimen and host evidence.\nother | Directory exclusion list: system32, windows, program files, program files(x86), temp, recycle.bin, $recycle.bin, boot, perflogs, appdata, documents and settings | context_only | Context artifact; correlate with specimen and host evidence.\nother | SystemFunction036 | context_only | Context artifact; correlate with specimen and host evidence.\ndebug_guid | 9BA97AD6-2A69-4035-860A-67CD1ED799E5 | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--0b7dcbc2-d666-581b-877f-b8a3a757785b", "malware--d8c056ef-d325-5dce-9925-870aead61ebc" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--cb519aaa-2b3e-5301-a025-5197442ac9c4", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "DynoWiper — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A Windows disk wiper enumerates fixed and removable drives, overwrites file content using a PRNG-generated pattern and performs a subsequent deletion pass.\n\nThe orchestrator seeds a Mersenne Twister using RtlGenRandom, enumerates logical drives and selects fixed and removable volumes. Its directory walk applies an exclusion list that includes Windows and Program Files paths.\n\nFor selected files, it clears attributes and writes a 16-byte buffer at the header and at up to 4,096 PRNG-selected offsets. After five seconds, it recursively deletes files. This overwrite-and-delete sequence implements the wiping behavior.\n\nThe executable contains the build path `C:\\Users\\vagrant\\Documents\\Visual Studio 2013\\Projects\\Source\\Release\\Source.pdb`. Caronte identifies the enumeration and write functions responsible for local file destruction; no command-channel role is assigned.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The report describes the acquired wiper's code; the affected host's telemetry establishes the files actually changed.", "object_refs": [ "file--0b7dcbc2-d666-581b-877f-b8a3a757785b", "malware--d8c056ef-d325-5dce-9925-870aead61ebc", "indicator--003cc180-fc81-57b0-a166-1014b9d2b8c5", "indicator--8ed9144c-aedd-502c-8e3f-e00162af0a53", "indicator--94db7a9e-3d81-5e00-a1d7-a9a8aa86bf6b", "note--23dbda4a-b7d0-5878-be11-4ddcf96bdc82" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160/" }, { "source_name": "Public research and attribution", "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--0190384a-0981-5791-bf91-12cecd980ecb", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "LummaStealer catalog specimen: evidence and contextual artifacts", "content": "A hash-verified LummaStealer catalog specimen with I386 PE structure and a retained static and reputation graph.\n\nReverse-engineering findings:\nThis entry documents the file identity, PE metadata and imported libraries. SHA-256, SHA-1 and MD5 are available for exact-file searches. Collection routines and network destinations are not assigned from the Lumma catalog label.\n\nEvidence scope: Available coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\n\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--d123f6d5-24c0-55c4-abca-b1cac2d37d68", "malware--69700569-e2fd-5de4-8dbc-01c4cacc88e8" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--9197c3d1-e2ed-57d7-8677-56295d23dda1", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LummaStealer catalog specimen — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A hash-verified LummaStealer catalog specimen with I386 PE structure and a retained static and reputation graph.\n\nThis entry documents the file identity, PE metadata and imported libraries. SHA-256, SHA-1 and MD5 are available for exact-file searches. Collection routines and network destinations are not assigned from the Lumma catalog label.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Available coverage for this specimen is file identity, static metadata and the retrieved reputation graph. The saved response is truncated; this is a file-identification record, not a completed reverse-engineering analysis.", "object_refs": [ "file--d123f6d5-24c0-55c4-abca-b1cac2d37d68", "malware--69700569-e2fd-5de4-8dbc-01c4cacc88e8", "indicator--0767258a-927f-57ac-ba04-ca6b3a69129a", "indicator--46b76715-f3aa-5c57-b7d9-3a4cc7bdf3a5", "indicator--295bbf9e-7e1a-5315-8ff5-e50242eda7ad", "note--0190384a-0981-5791-bf91-12cecd980ecb" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/30a8365303ef8233d566a4a55f5d8f21cb5020444045537a489b89a0013cecb9/" }, { "source_name": "Public research and attribution", "url": "https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--319a0ee4-9946-51d3-9c79-02d4d5ff3998", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "RedLineStealer: evidence and contextual artifacts", "content": "A managed RedLine-style infostealer implements browser and wallet collection, host profiling and a WCF task-processing workflow.\n\nReverse-engineering findings:\nThe report maps EntryPoint configuration fields, EndpointConnection WCF methods and ResultFactory collection actions. Collection routines cover browser credentials, cookies, autofill and payment data, with SQLite parsing and DPAPI/BCrypt AES-GCM operations.\n\nAdditional targets include wallet extensions and wallet folders, Telegram tdata, Discord leveldb, FileZilla and VPN configuration. Host profiling uses WMI and screenshot capture. DownloadAndExecuteUpdate, CommandLineUpdate and OpenUpdate implement operator-task handling.\n\nCaronte lists `194.156.79.165:55615` and its HTTP URL as endpoint candidates, alongside code references and the campaign marker `cheat`. They remain in the feed's context section. Services such as ipinfo.io serve a separate public-IP or geolocation lookup role.\n\nEvidence scope: 194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nip | 194.156.79.165 | candidate_unverified | Endpoint candidate according to the final recovery-validation state; retained as context rather than a detection indicator.\nurl | http://194.156.79.165:55615/ | candidate_unverified | Endpoint candidate according to the final recovery-validation state; retained as context rather than a detection indicator.\ndomain | api.ipify.org | legitimate_shared_service | Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\ndomain | api.ip.sb | legitimate_shared_service | Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\ndomain | ipinfo.io | legitimate_shared_service | Legitimate or shared service. Use by this specimen does not make the domain a standalone malicious indicator.\nother | cheat | context_only | Context artifact; correlate with specimen and host evidence.\nregistry_key | SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall | context_only | Context artifact; correlate with specimen and host evidence.\nregistry_key | SOFTWARE\\Clients\\StartMenuInternet | context_only | Context artifact; correlate with specimen and host evidence.\nregistry_key | Software\\Valve\\Steam | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %USERPROFILE%\\AppData\\Roaming\\Telegram Desktop\\tdata | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %appdata%\\discord\\Local Storage\\leveldb | context_only | Context artifact; correlate with specimen and host evidence.\nfile_path | %appdata%\\FileZilla\\recentservers.xml | context_only | Context artifact; correlate with specimen and host evidence.\nprocess_name | Implosions.exe | correlation_artifact | Correlate this marker with the hash, process and time. Expand environment variables and interpret wildcards in the receiving SIEM.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--8381ece1-dbe4-51c2-b6ce-a2bd52f49525", "malware--e556115b-e426-5e86-8967-0bb4ec693014" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--bcdb9b73-2128-5403-9b03-f72c1309430b", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "RedLineStealer — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A managed RedLine-style infostealer implements browser and wallet collection, host profiling and a WCF task-processing workflow.\n\nThe report maps EntryPoint configuration fields, EndpointConnection WCF methods and ResultFactory collection actions. Collection routines cover browser credentials, cookies, autofill and payment data, with SQLite parsing and DPAPI/BCrypt AES-GCM operations.\n\nAdditional targets include wallet extensions and wallet folders, Telegram tdata, Discord leveldb, FileZilla and VPN configuration. Host profiling uses WMI and screenshot capture. DownloadAndExecuteUpdate, CommandLineUpdate and OpenUpdate implement operator-task handling.\n\nCaronte lists `194.156.79.165:55615` and its HTTP URL as endpoint candidates, alongside code references and the campaign marker `cheat`. They remain in the feed's context section. Services such as ipinfo.io serve a separate public-IP or geolocation lookup role.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: 194.156.79.165:55615 remains a contextual candidate under the returned evidence classification, not a reviewed detection indicator.", "object_refs": [ "file--8381ece1-dbe4-51c2-b6ce-a2bd52f49525", "malware--e556115b-e426-5e86-8967-0bb4ec693014", "indicator--1dd6db8f-df87-52c2-9f6d-5225364686fe", "indicator--f9773a2e-6d82-56cd-90f8-edaf10a90409", "indicator--01fd8b5b-6c3a-5999-b822-c946808792b4", "note--319a0ee4-9946-51d3-9c79-02d4d5ff3998" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/1d48be9c03830f5749c64e7c002a02a32392892f53fa3a53d4a8664415bf30c5/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--53bfb968-70c4-5399-9912-af11bd666211", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "LockBit catalog specimen: evidence and contextual artifacts", "content": "A Windows specimen catalog-labelled LockBit (Caronte family confidence: possible) decodes stack-built strings, resolves APIs by hash, removes shadow copies and gates file encryption on an HTTPS response from docrack.me.\n\nReverse-engineering findings:\nStrings are decoded with per-string modular multiplication, and an API-hash resolver caches function addresses. The code deletes shadow copies through WMIC, uses Restart Manager to unlock files, traverses drives and directories, and implements file encryption. CryptoAPI provider names and ChaCha constants appear in those routines.\n\nThe entry path at `FUN_14001f880` passes the UTF-16 URL `https://docrack.me` into `FUN_14001f480`. Caronte traces WinHttpCrackUrl, WinHttpConnect, a GET request and a status check that allows the subsequent stage to proceed on a 2xx response. The endpoint's documented role is an HTTPS execution gate.\n\nWe found the URL's UTF-16LE bytes at file offset 236048 in the hash-verified sample. No server contact or sample execution was needed for that check. The feed includes the exact URL and hostname/TCP-443 pair.\n\nEvidence scope: The HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nuser_agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nprocess_name | WMIC.exe | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nfile_path | C:\\Windows\\System32\\wbem\\WMIC.exe | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | Microsoft Enhanced RSA and AES Cryptographic Provider | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--88917cf0-5b48-5a1e-b316-3b8a25c357b5", "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--c7285ec0-dd60-560c-86a8-c85fe21d34c5", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A Windows specimen catalog-labelled LockBit (Caronte family confidence: possible) decodes stack-built strings, resolves APIs by hash, removes shadow copies and gates file encryption on an HTTPS response from docrack.me.\n\nStrings are decoded with per-string modular multiplication, and an API-hash resolver caches function addresses. The code deletes shadow copies through WMIC, uses Restart Manager to unlock files, traverses drives and directories, and implements file encryption. CryptoAPI provider names and ChaCha constants appear in those routines.\n\nThe entry path at `FUN_14001f880` passes the UTF-16 URL `https://docrack.me` into `FUN_14001f480`. Caronte traces WinHttpCrackUrl, WinHttpConnect, a GET request and a status check that allows the subsequent stage to proceed on a 2xx response. The endpoint's documented role is an HTTPS execution gate.\n\nWe found the URL's UTF-16LE bytes at file offset 236048 in the hash-verified sample. No server contact or sample execution was needed for that check. The feed includes the exact URL and hostname/TCP-443 pair.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The HTTPS URL is independently present in the sample; its execution-gate role is traced in the Caronte report. Caronte fetched the docrack.me home page during analysis. Our independent byte check made no endpoint contact; ownership and availability have not been revalidated for publication. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.", "object_refs": [ "file--88917cf0-5b48-5a1e-b316-3b8a25c357b5", "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2", "indicator--5d5802b7-7859-5378-8e95-be8cdcbf8d06", "indicator--f6367393-ae10-5d49-ae5f-1438b9b6c18b", "indicator--f1eb744f-7d9c-5894-a42e-3f3f80b4a116", "note--53bfb968-70c4-5399-9912-af11bd666211", "indicator--b0930c77-eda1-515e-a9d9-26ff14ace552", "indicator--05b6ae91-43a0-52b7-9229-fcc9d3d71d12" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--2d391401-ba45-5296-ab6b-8f4fb49a2da7", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Vidar catalog specimen: evidence and contextual artifacts", "content": "The Vidar catalog specimen is a Go executable with obfuscated application identifiers, indirect API resolution and large unreferenced padding regions.\n\nReverse-engineering findings:\nCaronte maps randomized main-package identifiers and a three-field template `{{.canton}}:{{.field}}:{{.fly}}`, alongside Adler32 and base32 operations. Windows interaction is routed through LoadLibrary, GetProcAddress, SyscallN and LazyProc.Call indirection.\n\nConcrete API literals include VirtualAlloc and GetModuleFileNameW. The analysis separates roughly 540 KB of unreferenced, high-entropy .rdata padding from code-referenced data, using pointer, relocation and RIP-relative reference checks.\n\nThe module name and template are useful markers for comparing this file with other Go artifacts. Vidar remains the catalog label: the findings above do not establish browser theft, a network destination or a later payload.\n\nEvidence scope: Vidar is the catalog context. The reported code findings describe the acquired Go artifact.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nother | QuantumPointCollective | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | {{.canton}}:{{.field}}:{{.fly}} | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--85b594b8-6d12-50a5-828a-9bdbdfac7805", "malware--92852673-9316-5e89-b724-03e7238c43c4" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--f5e935dd-a811-5b75-9c57-60f7de5369f6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Vidar catalog specimen — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "The Vidar catalog specimen is a Go executable with obfuscated application identifiers, indirect API resolution and large unreferenced padding regions.\n\nCaronte maps randomized main-package identifiers and a three-field template `{{.canton}}:{{.field}}:{{.fly}}`, alongside Adler32 and base32 operations. Windows interaction is routed through LoadLibrary, GetProcAddress, SyscallN and LazyProc.Call indirection.\n\nConcrete API literals include VirtualAlloc and GetModuleFileNameW. The analysis separates roughly 540 KB of unreferenced, high-entropy .rdata padding from code-referenced data, using pointer, relocation and RIP-relative reference checks.\n\nThe module name and template are useful markers for comparing this file with other Go artifacts. Vidar remains the catalog label: the findings above do not establish browser theft, a network destination or a later payload.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Vidar is the catalog context. The reported code findings describe the acquired Go artifact.", "object_refs": [ "file--85b594b8-6d12-50a5-828a-9bdbdfac7805", "malware--92852673-9316-5e89-b724-03e7238c43c4", "indicator--685d8e16-9123-5d89-a5ec-85b4c556f50e", "indicator--00d5e2ef-916c-58ca-8cbc-9555c0625268", "indicator--b960d958-1af9-560b-bc02-82ca103fa2f6", "note--2d391401-ba45-5296-ab6b-8f4fb49a2da7" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/d458e481a291f6ee8ffeb9eaa6ec2a7442924b1ca5ac6c46a97b0e1a8a0bc0f2/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/overview-of-the-russian-speaking-infostealer-ecosystem-the-distribution" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--41a1645d-1d48-5a9a-b753-225d70f6dd4e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Stealc catalog specimen: evidence and contextual artifacts", "content": "The Stealc catalog specimen is a Go 1.21.1 executable with selectively renamed application symbols and synthetic high-entropy padding.\n\nReverse-engineering findings:\nThe report identifies 37 renamed main-package functions while the surrounding Go runtime and syscall symbols retain their standard names. Build information records trimpath and CGO_ENABLED=0.\n\nThree unreferenced `.rdata` runs total roughly 694 KB. Their byte differences repeat a +25/-3 arithmetic progression with period-256 autocorrelation, supporting their identification as generated filler.\n\nThe feed groups the application module, registry and API markers, Go runtime tables and certificate-validation URLs by their roles. Region fingerprints identify byte ranges within this file, not separately acquired payloads.\n\nEvidence scope: Stealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nother | go1.21.1 / GOARCH=amd64 / GOOS=windows / -trimpath=true / CGO_ENABLED=0 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nregistry_key | SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones | correlation_artifact | Shared system or application marker; use in combination with specimen-specific behaviour.\nother | a9fc80d6897ec1e7b9fe2177fd6f639b33f6d427fe1fe362bc1b92a280918a1e | reported_region_fingerprint | Fingerprint associated with a reported byte region. It is not the identity hash of an acquired malware file.\nother | 5e476c9328bb5f35321b244ba047493e4651dda7fbc8305a8206982701147659 | reported_region_fingerprint | Fingerprint associated with a reported byte region. It is not the identity hash of an acquired malware file.\nother | 53225acd7fd7b6022aae9d235af59c6f60457b9e4952783ac27c958d13c71d4f | reported_region_fingerprint | Fingerprint associated with a reported byte region. It is not the identity hash of an acquired malware file.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--d35a98db-1e41-553b-9a53-c97425bd4552", "malware--5aaacca0-b42f-53f9-b0e5-17fdab2056ff" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--94fca328-5d76-58cf-bf29-97debf97f08a", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Stealc catalog specimen — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "The Stealc catalog specimen is a Go 1.21.1 executable with selectively renamed application symbols and synthetic high-entropy padding.\n\nThe report identifies 37 renamed main-package functions while the surrounding Go runtime and syscall symbols retain their standard names. Build information records trimpath and CGO_ENABLED=0.\n\nThree unreferenced `.rdata` runs total roughly 694 KB. Their byte differences repeat a +25/-3 arithmetic progression with period-256 autocorrelation, supporting their identification as generated filler.\n\nThe feed groups the application module, registry and API markers, Go runtime tables and certificate-validation URLs by their roles. Region fingerprints identify byte ranges within this file, not separately acquired payloads.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Stealc is the catalog context. Region fingerprints and certificate-validation URLs are contextual artifacts, not standalone malware-file or C2 indicators. Stealc remains the catalog label. The findings describe Go code and build artifacts and do not show stealer behaviour.", "object_refs": [ "file--d35a98db-1e41-553b-9a53-c97425bd4552", "malware--5aaacca0-b42f-53f9-b0e5-17fdab2056ff", "indicator--f47960d5-1745-5a1c-97a2-739a51181f29", "indicator--f4ac4c28-d56f-5e86-a193-2b6e2bb24047", "indicator--09147ef2-7864-5df7-a0ab-23b04e643183", "note--41a1645d-1d48-5a9a-b753-225d70f6dd4e" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/0d3c25a7842f86f9fe36aaf59b9800301d8e73349fda54f93b6bc82d84700f9f/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--e7ec9ffd-d1b4-5ff5-973f-689f53490dec", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "Rhadamanthys / two retained specimens: evidence and contextual artifacts", "content": "The smaller Rhadamanthys catalog specimen is an AES-packed x64 loader with a runtime function-pointer table, memory-protection changes and mixed boolean-arithmetic obfuscation.\n\nReverse-engineering findings:\nCaronte identifies a 294,912-byte encrypted .data blob beginning at file offset 0x6a600, preceded by a plaintext offset table. A compiled Rijndael implementation includes forward and inverse AES S-boxes at 0x140055d20 and 0x140056d30.\n\nLoadLibraryA and GetProcAddress populate a writable .fptable section at runtime. VirtualProtect calls at 0x140046390, 0x140046869 and 0x14004689a accompany the table and memory-permission transitions. The code uses CRC32 tables and a repeated arithmetic base constant `0xa6e3f6f3215ead45`.\n\nThe encrypted blob, offset table and runtime API resolution describe the smaller file's packed-loader structure. All addresses and region fingerprints in this report refer to its SHA-256.\n\nEvidence scope: The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\nother | .data payload blob at file offset 0x6a600, length 294912, entropy 7.999 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | AES forward S-box VA 0x140055d20 / inverse S-box VA 0x140056d30 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | MBA obfuscation base constant 0xa6e3f6f3215ead45 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--3123c05a-ff95-5446-b7e3-8370825304db", "file--8a024b54-e855-5a46-8079-707c7c1ac3f5", "malware--852ebd13-8b05-5686-b387-2e7842854f58", "malware--47c27712-1816-58ca-856c-4bf7cd81e826" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--4168bf04-baa9-598b-af68-ccbb4b01126e", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "Rhadamanthys / two retained specimens — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "The smaller Rhadamanthys catalog specimen is an AES-packed x64 loader with a runtime function-pointer table, memory-protection changes and mixed boolean-arithmetic obfuscation.\n\nCaronte identifies a 294,912-byte encrypted .data blob beginning at file offset 0x6a600, preceded by a plaintext offset table. A compiled Rijndael implementation includes forward and inverse AES S-boxes at 0x140055d20 and 0x140056d30.\n\nLoadLibraryA and GetProcAddress populate a writable .fptable section at runtime. VirtualProtect calls at 0x140046390, 0x140046869 and 0x14004689a accompany the table and memory-permission transitions. The code uses CRC32 tables and a repeated arithmetic base constant `0xa6e3f6f3215ead45`.\n\nThe encrypted blob, offset table and runtime API resolution describe the smaller file's packed-loader structure. All addresses and region fingerprints in this report refer to its SHA-256.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: The completed loader report belongs to SHA-256 6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5; results are not transferred to the separate 32 MB file. Rhadamanthys remains the catalog label. The findings describe the smaller file's packed-loader structure and do not show stealer behaviour.", "object_refs": [ "file--3123c05a-ff95-5446-b7e3-8370825304db", "file--8a024b54-e855-5a46-8079-707c7c1ac3f5", "malware--852ebd13-8b05-5686-b387-2e7842854f58", "malware--47c27712-1816-58ca-856c-4bf7cd81e826", "indicator--c8290309-e36b-541f-b584-cbdeebe58e1c", "indicator--aa4045f1-0514-57cf-b72d-e8cc2cc415e6", "indicator--3d11694e-16a4-52e1-b6a8-ba7a7f4a3fcc", "indicator--823f1f63-d1ef-57f2-a803-370bee571f60", "indicator--5d4c5ae5-4b97-55da-a679-5c34e41ec90f", "indicator--74044e28-c979-5d4a-87aa-1d5df0b9421f", "note--e7ec9ffd-d1b4-5ff5-973f-689f53490dec" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5/" }, { "source_name": "Public research and attribution", "url": "https://www.sekoia.com/blog/clickfix-tactic-the-phantom-meet" } ] }, { "type": "note", "spec_version": "2.1", "id": "note--88980c4c-6e29-5d3e-be0c-da0df3334154", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "abstract": "The Gentlemen: evidence and contextual artifacts", "content": "A Go Linux ransomware executable combines operator-supplied password/path arguments, configurable partial encryption, service shutdown, persistence and a ransom-note workflow.\n\nReverse-engineering findings:\nThe encryption tool requires password and target-path arguments and provides delay, silent, keep and wipe options, plus partial-encryption modes covering 27%, 9%, 3% or 1% of a file. The report identifies an embedded X25519 public key and linked AES, SHA and HMAC routines.\n\nA pre-encryption command sequence mounts selected storage, stops Docker and Podman containers, powers off Nutanix guests, stops database services and Synology packages, and removes multiple log and recovery-related locations. The report also maps gautostart.service and an @reboot cron entry.\n\n`README-GENTLEMEN.txt` supplies a victim identifier and negotiation contacts: a Tor site, a clearnet mirror, a SimpleX invitation and a TOX identifier. The feed labels them as ransom-note contacts; they are not identified as the executable's command channel.\n\nEvidence scope: Ransom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.\nAttribution: The cited campaign or ecosystem association is public research context. Specimen-level operator attribution is recorded separately.\n\nContext observations (not standalone detection indicators):\ndomain | tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion | ransom_note_contact | Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\nip | 193.143.1.142 | ransom_note_contact | Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\nurl | https://smp16.simplex.im/a#yUc3Z5usvD4NpDvvAHmrBk6Wm_4zeYw5RRreY_NHhtc | ransom_note_contact | Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\nurl | https://x.com/TheGentlemen26 | ransom_note_contact | Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\nfile_path | README-GENTLEMEN.txt | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nfile_path | /etc/systemd/system/gautostart.service | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nservice | gautostart.service | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | C3429265C69E82195A7D3F9F95E05E2168BB87F90FC6C41B8F1D0B68544DDF7769808B2872FB | ransom_note_contact | Out-of-band contact embedded in the ransom note; this is not an executable command-and-control destination.\nother | RWMmtkZTwQvM8HjjuyvLPQcypSKm88ZpXGxGqhZTrQc= | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | 094803a4bd0ca36af17131ab1beb92a5 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | #g-autostart | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\nother | LOCKER_BACKGROUND=1 | correlation_artifact | Reported code or host artifact; correlate with the exact specimen, process and time.\n\nAnalysis network activity: Caronte made network requests to extracted endpoints in 11 cases during the saved analyses, including fetching the docrack.me home page. Attempts to reach Prime at 89.44.9.186:3240 and ChocoShell's server failed. These requests are analysis activity, not malware-execution telemetry. No publication-time endpoint revalidation was performed.", "object_refs": [ "file--ac8d5c2c-9e4f-545d-bf63-ff3df8b4a820", "malware--9ff992ee-9f41-5739-a5d1-ffb624df0c79" ], "authors": [ "Beelzebub Labs" ] }, { "type": "report", "spec_version": "2.1", "id": "report--71058199-797b-5f50-a0b0-c9155bd5ace6", "created": "2026-11-08T21:21:50.696Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "The Gentlemen — research refreshed 9 November 2026", "published": "2026-11-08T21:21:50.696Z", "report_types": [ "malware" ], "description": "A Go Linux ransomware executable combines operator-supplied password/path arguments, configurable partial encryption, service shutdown, persistence and a ransom-note workflow.\n\nThe encryption tool requires password and target-path arguments and provides delay, silent, keep and wipe options, plus partial-encryption modes covering 27%, 9%, 3% or 1% of a file. The report identifies an embedded X25519 public key and linked AES, SHA and HMAC routines.\n\nA pre-encryption command sequence mounts selected storage, stops Docker and Podman containers, powers off Nutanix guests, stops database services and Synology packages, and removes multiple log and recovery-related locations. The report also maps gautostart.service and an @reboot cron entry.\n\n`README-GENTLEMEN.txt` supplies a victim identifier and negotiation contacts: a Tor site, a clearnet mirror, a SimpleX invitation and a TOX identifier. The feed labels them as ransom-note contacts; they are not identified as the executable's command channel.\n\nAnalysis retrieved: 2026-11-09T09:02:26.551373+00:00\nEvidence scope: Ransom-note domains, IPs and contact handles are out-of-band negotiation artifacts, not executable C2 destinations.", "object_refs": [ "file--ac8d5c2c-9e4f-545d-bf63-ff3df8b4a820", "malware--9ff992ee-9f41-5739-a5d1-ffb624df0c79", "indicator--f8748750-e330-5863-baf7-1bd6b9e1cf98", "indicator--0f1f74d0-f699-54e2-8f69-9bad6893bbd6", "indicator--ad66d124-d714-5f2f-9c95-059053249c1b", "note--88980c4c-6e29-5d3e-be0c-da0df3334154" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/53d2484ae1ad6ff9547d90f5f5ccd6ae1dca8cb24e622a07dfc74c9593b2c3fa/" }, { "source_name": "Public research and attribution", "url": "https://research.checkpoint.com/2026/the-state-of-ransomware-q1-2026/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b0930c77-eda1-515e-a9d9-26ff14ace552", "created": "2026-11-09T15:47:13.000Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen / URL hxxps://docrack[.]me", "description": "UTF-16LE URL independently verified at decimal file offset 236048 in the hash-verified specimen. Caronte traces WinHTTP GET and a 2xx status check before encryption.\nRole: https_execution_gate\nMatching: exact_url\nThe HTTPS status gates execution. This record does not assert successful encryption on a victim or a currently active command service. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[url:value = 'https://docrack.me']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-09T15:47:13.000Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" }, { "source_name": "Independent literal verification", "url": "https://beelzebub.ai/feeds/russia-malware-2026-11-09/lockbit-endpoint-verification.json" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8c6f6c63-d96b-51d9-b38e-cc3683b6d33e", "created": "2026-11-09T15:47:13.000Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--b0930c77-eda1-515e-a9d9-26ff14ace552", "target_ref": "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--05b6ae91-43a0-52b7-9229-fcc9d3d71d12", "created": "2026-11-09T15:47:13.000Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "name": "LockBit catalog specimen / DOMAIN-NAME docrack[.]me", "description": "UTF-16LE URL independently verified at decimal file offset 236048 in the hash-verified specimen. Caronte traces WinHTTP GET and a 2xx status check before encryption.\nRole: https_execution_gate\nMatching: destination_and_port\nThe HTTPS status gates execution. This record does not assert successful encryption on a victim or a currently active command service. LockBit is the catalog label; Caronte rates the family only as possible and found no family-specific mutex, ransom-note filename, extension or decryption ID. The software-crack filename and HTTPS execution gate do not establish ransomware infrastructure or malicious ownership of docrack.me.\nUse: retrospective hunting with local analyst review. valid_from is the original indicator release date.", "pattern": "[network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'docrack.me' AND network-traffic:dst_port = 443 AND network-traffic:protocols[*] = 'tcp']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-11-09T15:47:13.000Z", "indicator_types": [ "malicious-activity" ], "confidence": 85, "labels": [ "retrospective-hunt", "no-automatic-blocking", "reviewed_static_configuration" ], "external_references": [ { "source_name": "MalwareBazaar", "url": "https://bazaar.abuse.ch/sample/99b41a3ffef3e2d26ad47f46e616dae81b3991c3705a7892a92e2ffd74307658/" }, { "source_name": "Public research and attribution", "url": "https://www.justice.gov/usao-nj/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" }, { "source_name": "Independent literal verification", "url": "https://beelzebub.ai/feeds/russia-malware-2026-11-09/lockbit-endpoint-verification.json" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e28f58b1-21eb-5fa1-92e6-a00a0ee6b576", "created": "2026-11-09T15:47:13.000Z", "modified": "2026-11-09T15:47:13.000Z", "created_by_ref": "identity--42e33903-25af-504d-a673-0f5a1a27f8bc", "lang": "en", "relationship_type": "indicates", "source_ref": "indicator--05b6ae91-43a0-52b7-9229-fcc9d3d71d12", "target_ref": "malware--68ac4c8e-026a-5a7f-8d76-b561b680afe2" } ] }