{ "type": "bundle", "id": "bundle--87dfd514-7dd5-4082-81b4-28ffadb0d0d2", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.472193Z", "modified": "2026-07-27T01:08:14.472193Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--4b71d564-32d7-556a-803e-bd7ef551da93", "value": "149.28.112.221" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--062fdbcf-73ce-56c8-abb2-1031444f5507", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.473657Z", "modified": "2026-07-27T01:08:14.473657Z", "name": "ipv4: 149.28.112.221", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.112.221']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 95 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--556c62ae-9de8-5bb6-978a-d7dc2b0b7b75", "value": "122.51.91.77" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ebacba11-f06a-5b8e-a4f4-86a52ea8796e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.478021Z", "modified": "2026-07-27T01:08:14.478021Z", "name": "ipv4: 122.51.91.77", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '122.51.91.77']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 95 }, { "type": "url", "spec_version": "2.1", "id": "url--69fceb3b-31f5-58d9-8ff6-95f1903ff6a5", "value": "http://149.28.112.221:8080/miner.sh" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6d6c54df-04a6-5c52-8ad3-736345eef715", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.47866Z", "modified": "2026-07-27T01:08:14.47866Z", "name": "url: http://149.28.112.221:8080/miner.sh", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/miner.sh']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--9dccdcc1-15ea-5034-85d2-32a6bfee7195", "value": "http://149.28.112.221:8080/xmrig.zip" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--789e9b4c-8105-5f2d-a1c4-ae7750a15876", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.479548Z", "modified": "2026-07-27T01:08:14.479548Z", "name": "url: http://149.28.112.221:8080/xmrig.zip", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/xmrig.zip']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--f59d3818-cd2d-53a1-b821-537812548714", "value": "http://149.28.112.221:8080/deploy.bat" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8b13c7e4-d123-54b8-a378-c42be0ea2487", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.48008Z", "modified": "2026-07-27T01:08:14.48008Z", "name": "url: http://149.28.112.221:8080/deploy.bat", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/deploy.bat']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--c63162c7-fa4e-599e-857e-e0c01341a73d", "value": "http://149.28.112.221:8080/deploy.ps1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0625c74-2d57-5795-a2bf-6dbc60dd3711", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.480695Z", "modified": "2026-07-27T01:08:14.480695Z", "name": "url: http://149.28.112.221:8080/deploy.ps1", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/deploy.ps1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--b38ca17b-d149-54d5-9221-e5e2cbbae7be", "value": "http://149.28.112.221:8080/allinone.ps1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bfdfee33-a0c0-5ab9-8dae-fb2fb3e6dda0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.482175Z", "modified": "2026-07-27T01:08:14.482175Z", "name": "url: http://149.28.112.221:8080/allinone.ps1", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/allinone.ps1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--52d6a7d6-d5c1-5e5d-960a-724aed7a6998", "value": "http://149.28.112.221:8080/worm.vbs" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--01a00eee-856e-59b9-a983-d58010a28943", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.48288Z", "modified": "2026-07-27T01:08:14.48288Z", "name": "url: http://149.28.112.221:8080/worm.vbs", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/worm.vbs']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--b43f60ac-9948-5924-b762-50acc0643d0b", "value": "http://149.28.112.221:8080/infect.ps1" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--416d8066-9af3-5e3a-873b-1ffeeec7e4f8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.483414Z", "modified": "2026-07-27T01:08:14.483414Z", "name": "url: http://149.28.112.221:8080/infect.ps1", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/infect.ps1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--1eb51c26-4949-5de8-8c16-c7d2169d5932", "value": "http://149.28.112.221:8080/xmrig-win64.zip" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--da672148-f496-50d3-bf8e-cb66fab40052", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.483913Z", "modified": "2026-07-27T01:08:14.483913Z", "name": "url: http://149.28.112.221:8080/xmrig-win64.zip", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/xmrig-win64.zip']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": true, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--e2a141b8-0aab-54fb-bd8d-5b2280a24673", "value": "http://149.28.112.221:8080/config.json" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d745861e-9414-5de2-a87b-9d213438492b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.484419Z", "modified": "2026-07-27T01:08:14.484419Z", "name": "url: http://149.28.112.221:8080/config.json", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://149.28.112.221:8080/config.json']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--73087b89-df73-57b6-8b83-19d276c39d28", "value": "auto.c3pool.org" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4ba05cb5-2063-59d1-8c76-2a9f0848f359", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.484905Z", "modified": "2026-07-27T01:08:14.484905Z", "name": "domain: auto.c3pool.org", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'auto.c3pool.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--e87dbbef-6b5f-50dd-8c69-3522616eea5d", "value": "pool.supportxmr.com" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5f26c492-8724-512d-a7ad-44db108d7668", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.485635Z", "modified": "2026-07-27T01:08:14.485635Z", "name": "domain: pool.supportxmr.com", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pool.supportxmr.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--404c360e-cfa0-5cdb-8006-56025ca29ce8", "value": "xmrpool.eu" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4d07e30-7e3f-5666-9f5e-6e5c935ddc7d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.486136Z", "modified": "2026-07-27T01:08:14.486136Z", "name": "domain: xmrpool.eu", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'xmrpool.eu']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--8048475d-f33a-5f54-b16d-077e2703c8ce", "value": "download.c3pool.org" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e36f27e6-ae4b-5f74-8405-1d929be77cc6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.48661Z", "modified": "2026-07-27T01:08:14.48661Z", "name": "domain: download.c3pool.org", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'download.c3pool.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-26T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 60 }, { "type": "file", "spec_version": "2.1", "id": "file--666d2217-344d-5c81-9f9f-695d4e47e261", "hashes": { "SHA-256": "55aec7f75af2e0489ff72c28322eccdfbc946cc00f539c2051382877cac03426" } }, { "type": "file", "spec_version": "2.1", "id": "file--10e9172c-ed57-5346-9920-778f892dd537", "hashes": { "SHA-256": "eb80f735708491d8d8ce530c565128466c3de35a5f71ccfc74cfaeddc2f56906" } }, { "type": "file", "spec_version": "2.1", "id": "file--7969d345-bb03-5fce-92a9-16ec9f640058", "hashes": { "SHA-256": "b5d14e96d3e3fa64942878356a5cdd678d4649bbd94a738d4a4eda6fbb23f73c" } }, { "type": "file", "spec_version": "2.1", "id": "file--f2e2956f-33a4-508e-b4b3-93ff6eb76fd3", "hashes": { "SHA-256": "5cdc82aa60c2e61afbaa9d07ca9768680f24691d92529f1a7b5f5009b0e983ad" } }, { "type": "file", "spec_version": "2.1", "id": "file--baaa4768-1bdd-52be-81c7-da8678fcdb41", "hashes": { "SHA-256": "c11d728f2b217bcae87d591c9c57ae858e51bf4d3dba66c895f0487138554cb9" } }, { "type": "file", "spec_version": "2.1", "id": "file--a574ae0b-b651-5d4d-bdf5-1e217b27d7d8", "hashes": { "SHA-256": "e362368c4278a61c5f839002c2978aefd9d9ee169604b7b77f6775ce16f436f9" } }, { "type": "file", "spec_version": "2.1", "id": "file--46543f5e-2acf-5317-896f-5c33869ff8e7", "hashes": { "SHA-256": "05da77d45a34b8b765bc1b167c13dc1a02948a6bc56318dc092f6ca3928dfe15" } }, { "type": "file", "spec_version": "2.1", "id": "file--71b5dcb6-909a-57c8-b2fd-213b50daf4e2", "hashes": { "SHA-256": "083089894dcad87d9b904fd4f8b77537a39ee92cc4cbfcb8aa707fefbe4e0793" } }, { "type": "file", "spec_version": "2.1", "id": "file--971968af-e5c5-5089-a49c-577895bdd5bc", "hashes": { "SHA-256": "12244cc4f0cd75f55813f5f7d58876bd2617f394b6e05f256ff490952f026a89" } }, { "type": "file", "spec_version": "2.1", "id": "file--8aea236c-ee2c-5a4b-8cc0-b1d7fc2c6c8d", "hashes": { "SHA-256": "f76c282b03bdde8d46a7a7963bad0573a22de85428bdb9bd7d9187e02407b5a2" } }, { "type": "file", "spec_version": "2.1", "id": "file--76e4c293-1566-5515-9703-8342cdd9c98d", "hashes": { "SHA-256": "a803409aba9b33053405ead81d78b41b60f9fd7d23bc2bb84abd79f4928a9f6d" } }, { "type": "file", "spec_version": "2.1", "id": "file--fce67db7-a003-5205-91ee-388b7a581d12", "hashes": { "SHA-256": "9867fbd3a153826434ec5c6897cd50b07fe4a44521c5879f929477d2ca3131c7" } }, { "type": "file", "spec_version": "2.1", "id": "file--3ef09793-26cf-5c78-9ec1-877645da1411", "hashes": { "SHA-256": "ed23790c390b5f66f775d9d61a0c44ca7a085d0a017f018704b1295f3e544792" } }, { "type": "file", "spec_version": "2.1", "id": "file--c156efb6-9d45-5922-8f45-7e8cbe046bd8", "hashes": { "SHA-256": "15285dc7c839ab6333829923953eb8d6b78896bf45ab09e58c42a8df2a305fcf" } }, { "type": "file", "spec_version": "2.1", "id": "file--6f81811d-7012-580f-84f5-9d22fd427127", "hashes": { "SHA-256": "ce7b0d28af186355cbaad547bc4f2c33c2dba531d4de332a73ae657b4a045247" } }, { "type": "file", "spec_version": "2.1", "id": "file--43854ce9-f77d-5a48-aa46-7c0dc08016d2", "hashes": { "SHA-256": "da6857dbf4f5cb3b02b14694cd0ad05b75461d8c835c96497bf5e4a300dbf406" } }, { "type": "file", "spec_version": "2.1", "id": "file--af054ca0-335f-587f-a22d-7bfb05e6f081", "hashes": { "SHA-256": "8e481b0e94a1a68daa3bcd07917376815f1c5b5fa7d1e4e08e52ee9bfb59a985" } }, { "type": "file", "spec_version": "2.1", "id": "file--3d9d9491-6984-52f0-874c-d070872d66ed", "hashes": { "SHA-256": "1f1ff47b72e29d746d129513a2e2c9bb7c09499a369ca02033867fd3c779aa13" } }, { "type": "file", "spec_version": "2.1", "id": "file--8cb17335-f63c-5ff7-b830-7c609d42833c", "hashes": { "SHA-256": "ef2e0baccff058ea01e498b1b3ad9b2e5c32a747a466d6dfe8e27e3dc5334f39" } }, { "type": "file", "spec_version": "2.1", "id": "file--b05a8598-ffe6-5f2f-b805-6244ccee1b21", "hashes": { "SHA-256": "84cf60ab90d870362d39e9ba137d8058865176c04275a49087ff6da1496db429" } }, { "type": "file", "spec_version": "2.1", "id": "file--155dfb5c-753a-5ce5-9b2a-89027bd54046", "hashes": { "SHA-256": "a7ee4a022b7275b523286af9c6eb70a1ed0c3f11938c704272dbdd4f78cac32d" } }, { "type": "file", "spec_version": "2.1", "id": "file--bea61bd8-abc5-5ec6-93fd-2de8ac806f04", "hashes": { "SHA-256": "8b4ab6726d42d4f5f972f68951b7449171ca9bbe7326c0170cec6f578f3677f2" } }, { "type": "file", "spec_version": "2.1", "id": "file--ea4dd2df-652c-5413-b4cc-f9b2dc97a89c", "hashes": { "SHA-256": "73576e66c3ac6dc2560e8b7c2248204604123f56d9af107537be6c992e58ef1e" } }, { "type": "file", "spec_version": "2.1", "id": "file--9f3746d3-fb8f-5879-8ccf-a64efd959faa", "hashes": { "SHA-256": "2991a9e980d61047d1d313a60222c4140188542c8f757d548a4c0bac45aadf61" } }, { "type": "file", "spec_version": "2.1", "id": "file--bdde0196-d4e7-545d-ae2f-c47f53e4a89c", "hashes": { "SHA-256": "f9e08584c52572a047f05cd6cf7ac57a94d3dd9ef71b4143b4161e8b0d168b34" } }, { "type": "file", "spec_version": "2.1", "id": "file--861e9ec9-4d74-5637-a0d2-f6a4193094ea", "hashes": { "SHA-256": "2b6ef3ed0039382655c915c9782612a7b728f067a7ec65bcbd2ed5ad5bf72cdd" } }, { "type": "file", "spec_version": "2.1", "id": "file--a07d7810-fe51-5f68-8616-35597d101a53", "hashes": { "SHA-256": "f6c69dd4222d23286908d228aee9500e1cd04f80b325c5452df9721977d1a057" } }, { "type": "file", "spec_version": "2.1", "id": "file--ba876101-a4c8-5a58-8dd4-f39dc1669d63", "hashes": { "SHA-256": "310d2a78c7bead6aa6573a2e9bc7da14e6c89231868a9589ff33a389de3fd326" } }, { "type": "file", "spec_version": "2.1", "id": "file--0cfc9fe0-341f-5d90-a310-54840b13d1d1", "hashes": { "SHA-256": "ede2225fd7df049f90f625bc525c9c6dbf809c4ca463a8f0e633f066997a3c59" } }, { "type": "file", "spec_version": "2.1", "id": "file--3f66710f-6889-5333-a7fc-5124ff6f9608", "hashes": { "SHA-256": "004315d53cc4e68b16f0a1acb1f09d9501ea26e6fde1686b2018cd677a346c5c" } }, { "type": "file", "spec_version": "2.1", "id": "file--a5abc2e3-0df8-5365-a086-6d11d351a3b8", "hashes": { "SHA-256": "5194aa67974a69549f1f839c973ca17cc0ce8c6ca41ab199d74599befba08db7" } }, { "type": "file", "spec_version": "2.1", "id": "file--660435f8-91c0-5830-8222-97eeac226590", "hashes": { "SHA-256": "c0c6f46cbadac40fddc0d3a2ec857e2f403201d57e2bd2a5a56256e37817b7d0" } }, { "type": "file", "spec_version": "2.1", "id": "file--37a43bb7-f92c-5114-a57b-44ed6ff2d532", "hashes": { "SHA-256": "f4c5ab27bceb6ab6c6ec8f48b3b84701a0ba6966e30042bf5765a5d97018b5d2" } }, { "type": "file", "spec_version": "2.1", "id": "file--3ff77666-08fa-560b-bcf7-b9645a97619d", "hashes": { "SHA-256": "f42af99f65f1edeb5ed13b3f68643e7d8abacfceb878ba7e79581caedbd7f09f" } }, { "type": "file", "spec_version": "2.1", "id": "file--f34c0c89-33f7-54dd-b949-21ec33db876f", "hashes": { "SHA-256": "6780e9cc6cad66975bb7d895cd0944b72c5a843b80f6c4fef3cc4ebeb1ce628a" } }, { "type": "file", "spec_version": "2.1", "id": "file--11ca896f-d19d-521d-bf4f-3c09314e476b", "hashes": { "SHA-256": "b47275a8e98d6df99f6b5619b73156c97c7355a193e2b7f728e6c0c80a5c82bb" } }, { "type": "file", "spec_version": "2.1", "id": "file--38cf0da3-7583-5386-811c-1e4da10e884d", "hashes": { "SHA-256": "cee14e449b9da683734b1f4122a40f1d6e478fe93015702137b62a79a5414ad3" } }, { "type": "file", "spec_version": "2.1", "id": "file--6d1922a9-13f1-556a-9fd6-9c9731678773", "hashes": { "SHA-256": "f800c809dfdc0ce22be0fe638734212380d99293fc466242b3fea6e6e858e9df" } }, { "type": "file", "spec_version": "2.1", "id": "file--cb61a78b-d110-57bf-a2cf-05c0c382801d", "hashes": { "SHA-256": "44a14aafec8482f691801e28a3893c1ae1fdfbbed4dce963b002b7095f6cb120" } }, { "type": "file", "spec_version": "2.1", "id": "file--6d31f319-6c53-5dae-8616-0817338a0a32", "hashes": { "SHA-256": "93c071da49e7746f0ba72472f0f51c642b70ba76fb52d1de21f3822a76d05c05" } }, { "type": "file", "spec_version": "2.1", "id": "file--07b53740-fd6a-58e9-8c32-37772ec92c05", "hashes": { "SHA-256": "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5" } }, { "type": "file", "spec_version": "2.1", "id": "file--449be8e9-1d63-51b2-bac7-1e10844213d6", "hashes": { "SHA-256": "eba9b6cdefd4d681985e90d200f1ec88b16c37b6d52a29146064872695f5867e" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fd2f5b58-8411-5874-a9a3-fe8d5f1271a5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.492674Z", "modified": "2026-07-27T01:08:14.492674Z", "name": "GOCLOUD_Windows_Deploy_Worm_Lingkai", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_Windows_Deploy_Worm_Lingkai {\n meta:\n description = \"Detects the GOCLOUD Windows internet-cafe miner deployment and LAN-propagation scripts (deploy.ps1 / allinone.ps1 / setup.bat, self-branded \u51cc\u51ef\u77ff\u673a v3.0) by the combination of the operator's mining-estate brand, its svchost/TimeService masquerade triad, and the checksum-invalid typo Monero wallet live in the runtime config\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"f4c5ab27bceb6ab6c6ec8f48b3b84701a0ba6966e30042bf5765a5d97018b5d2\"\n hash2 = \"f42af99f65f1edeb5ed13b3f68643e7d8abacfceb878ba7e79581caedbd7f09f\"\n hash3 = \"6780e9cc6cad66975bb7d895cd0944b72c5a843b80f6c4fef3cc4ebeb1ce628a\"\n family = \"GOCLOUD\"\n malware_type = \"Cryptojacking deployer / LAN worm\"\n id = \"5fec8734-b59b-5046-9a52-36e8061fb674\"\n strings:\n $brand = \"\u51cc\u51ef\u77ff\u673a\" ascii wide\n $netbar = \"\u7f51\u5427\" ascii wide\n $task1 = \"WindowsTimeSync\" ascii wide fullword\n $task2 = \"WindowsWatchdog\" ascii wide fullword\n $path = \"Microsoft\\\\Windows\\\\TimeService\" ascii wide nocase\n $wallettp = \"42CThVKA9SxeeQDT8EcBK7UHNFFREDw3q7W5ZyyoGvGufDVPbKzYb3Bap9z9qor7jwAU23r3jKHyoZCSYH8eK4a9BUyTRrE\" ascii wide\n $pool = \"pool.supportxmr.com:443\" ascii wide nocase\n $attr = \"attrib +H +S\" ascii wide nocase\n condition:\n filesize < 80KB and\n ( $wallettp or 3 of them )\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--168dc883-1d93-5ba9-bad9-937122a62137", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.49285Z", "modified": "2026-07-27T01:08:14.49285Z", "name": "GOCLOUD_Windows_Miner_WinJenkins", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_Windows_Miner_WinJenkins {\n meta:\n description = \"Detects the GOCLOUD winminer.ps1 Windows XMRig deployer by its WinJenkinsHeartbeat scheduled-task persistence, the per-host win_jenkins_ pool-password convention, pre-download Defender real-time-monitoring disable, and the fixed-order /r?host= mining heartbeat\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"004315d53cc4e68b16f0a1acb1f09d9501ea26e6fde1686b2018cd677a346c5c\"\n hash2 = \"446fedd99169500bbd34de06bc5890de445d7280\"\n hash3 = \"dbfc0b53520ad8ef434b38f322a91388\"\n family = \"GOCLOUD\"\n malware_type = \"Cryptojacking deployer\"\n id = \"2bf3f5bb-c1e9-5399-836e-8d4ed6b0bf60\"\n strings:\n $task = \"WinJenkinsHeartbeat\" ascii wide fullword\n $pass = \"win_jenkins_\" ascii wide\n $defoff = \"Set-MpPreference -DisableRealtimeMonitoring\" ascii wide nocase\n $hb = \"/r?host=\" ascii wide\n $worker = \"winjenkins_\" ascii wide\n $donate = \"\\\"donate-level\\\": 0\" ascii wide\n condition:\n filesize < 40KB and\n 3 of them\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2499b0e1-3893-5e8d-a19c-fb3791f619bb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.492988Z", "modified": "2026-07-27T01:08:14.492988Z", "name": "GOCLOUD_Linux_Miner_v7", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_Linux_Miner_v7 {\n meta:\n description = \"Detects the GOCLOUD miner.sh Linux XMRig deployer (GOCLOUD miner v7) by its self-branded banner, the /tmp/.X11-unix. dot-suffixed X11-socket-lookalike hiding directory, the c3pool_miner.service persistence unit, the gocloud_ worker-label convention, and the fixed-order /r?host= heartbeat\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"5194aa67974a69549f1f839c973ca17cc0ce8c6ca41ab199d74599befba08db7\"\n hash2 = \"5fe34b31fe3e3c741456ae6d3c55677cd1aff608\"\n hash3 = \"6177ab813f6bfeba9c3ec6aeeeb5780a\"\n family = \"GOCLOUD\"\n malware_type = \"Cryptojacking deployer\"\n id = \"fd42d64a-f3ac-51b4-b450-523467161f37\"\n strings:\n $banner = \"GOCLOUD miner v7\" ascii nocase\n $x11 = \"/tmp/.X11-unix.\" ascii\n $svc = \"c3pool_miner.service\" ascii\n $worker = \"gocloud_\" ascii\n $hb = \"/r?host=\" ascii\n $pool = \"auto.c3pool.org:19999\" ascii nocase\n condition:\n filesize < 40KB and\n ( ( $x11 and 2 of them ) or ( 4 of them ) )\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ca3de1fd-2477-5cf5-82ea-90a25897c375", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.493115Z", "modified": "2026-07-27T01:08:14.493115Z", "name": "GOCLOUD_BatchExploit_Dispatcher", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_BatchExploit_Dispatcher {\n meta:\n description = \"Detects the GOCLOUD BatchExploit central exploit dispatcher and its FOFA targeting engine (batch_exploit.py / fofa_batch.py) by the self-brand string, the operator's live FOFA API key, the ex_ prefixed exploit function family, and the miner.sh|bash delivery one-liner\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"55aec7f75af2e0489ff72c28322eccdfbc946cc00f539c2051382877cac03426\"\n hash2 = \"a4f85666972d0d2714153df0e74e3547ae304f3d\"\n hash3 = \"03164fbe18dde4df7d2838875de0b3f3\"\n family = \"GOCLOUD\"\n malware_type = \"Mass-exploitation dispatcher\"\n id = \"7500809e-561b-5ad7-99e7-5b77da81cce5\"\n strings:\n $brand = \"GOCLOUD BatchExploit\" ascii\n $fofakey = \"b435f2336553ea069d3848ac2c4574aa\" ascii\n $ex1 = \"def ex_redis\" ascii\n $ex2 = \"def ex_jenkins\" ascii\n $deliver = \"miner.sh|bash\" ascii\n $dict = \"EXPLOIT = {\" ascii\n $cn = \"country=\\\"CN\\\"\" ascii\n condition:\n filesize < 200KB and\n ( $brand or $fofakey ) and\n 2 of ($ex1, $ex2, $deliver, $dict, $cn)\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--25efeb92-5d0d-5adc-93ac-6e35a3c8578a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.493261Z", "modified": "2026-07-27T01:08:14.493261Z", "name": "GOCLOUD_OmniHunter_v4_Orchestrator", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_OmniHunter_v4_Orchestrator {\n meta:\n description = \"Detects the GOCLOUD OmniHunter v4 exploitation orchestrator (omnihunter.py, node 2) by its self-brand, the operator's shared FOFA API key, the tomcatwar.jsp webshell filename, the hardcoded Hikvision iSecure session cookie, and the rce_ prefixed module naming that distinguishes it from the ex_ GOCLOUD dispatcher\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"cee14e449b9da683734b1f4122a40f1d6e478fe93015702137b62a79a5414ad3\"\n family = \"GOCLOUD\"\n malware_type = \"Mass-exploitation orchestrator\"\n id = \"feb7afed-e952-5d6f-9b20-ff4e070e0bf6\"\n strings:\n $brand = \"OmniHunter\" ascii\n $fofakey = \"b435f2336553ea069d3848ac2c4574aa\" ascii\n $shell = \"tomcatwar.jsp\" ascii nocase\n $hik = \"ISMS_8700_Sessionname=ABCB193BD9D82CC2D6094F6ED4D81169\" ascii\n $rce = \"def rce_\" ascii\n $meta = \"def rce_metabase\" ascii\n condition:\n filesize < 200KB and\n $brand and\n 2 of ($fofakey, $shell, $hik, $rce, $meta)\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d36c8055-09c3-5542-a8f8-653728f43ca4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.493426Z", "modified": "2026-07-27T01:08:14.493426Z", "name": "GOCLOUD_Listener2_Control_Plane", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_Listener2_Control_Plane {\n meta:\n description = \"Detects the GOCLOUD node-2 reverse-shell control plane (listener2.py) by its unauthenticated CONTROL_PORT 9997 operator interface, the list / all: broadcast verbs, the fixed 4444-8888 shell-catch port set, and the id command auto-pushed on every reverse-shell connect\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"f800c809dfdc0ce22be0fe638734212380d99293fc466242b3fea6e6e858e9df\"\n family = \"GOCLOUD\"\n malware_type = \"Reverse-shell C2 controller\"\n id = \"986a37d8-3e5f-511e-b6f7-3569e89a1c54\"\n strings:\n $ctl = \"CONTROL_PORT\" ascii\n $port = \"9997\" ascii\n $verb1 = \"all:\" ascii\n $verb2 = \"list\" ascii\n $ports = \"4444\" ascii\n $auto = \"id\\\\n\" ascii\n condition:\n filesize < 60KB and\n $ctl and $port and 2 of ($verb1, $verb2, $ports, $auto)\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e686fb10-dd74-5606-9ae8-74c768796823", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.493595Z", "modified": "2026-07-27T01:08:14.493595Z", "name": "GOCLOUD_LAN_Probe_Attack_Banner", "indicator_types": [ "malicious-activity" ], "pattern": "rule GOCLOUD_LAN_Probe_Attack_Banner {\n meta:\n description = \"Detects the GOCLOUD node-2 LAN lateral-movement probe (a.py) by its cleartext === ATTACK === report banner, the SMB / WMI / SCHTASKS OK result markers it posts back to the operator, and its sequential net use against C$ / ADMIN$ / IPC$ administrative shares\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\"\n date = \"2026-07-26\"\n hash1 = \"44a14aafec8482f691801e28a3893c1ae1fdfbbed4dce963b002b7095f6cb120\"\n family = \"GOCLOUD\"\n malware_type = \"LAN lateral-movement probe\"\n id = \"e8cbbcc2-83b7-59dd-8e4e-b80ea72a5a4f\"\n strings:\n $banner = \"=== ATTACK ===\" ascii\n $smb = \"SMB\" ascii\n $wmi = \"WMI\" ascii\n $sch = \"SCHTASKS\" ascii\n $ok = \"OK!\" ascii\n $c = \"ADMIN$\" ascii\n $ipc = \"IPC$\" ascii\n condition:\n filesize < 60KB and\n $banner and 3 of ($smb, $wmi, $sch, $ok, $c, $ipc)\n}", "pattern_type": "yara", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b449a6e9-9f27-5a0e-8ddf-5934bf3e6321", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.493766Z", "modified": "2026-07-27T01:08:14.493766Z", "name": "Svchost.EXE Executed From Non-System Directory", "indicator_types": [ "malicious-activity" ], "pattern": "title: Svchost.EXE Executed From Non-System Directory\nid: d1fb7553-97d4-45f2-a10b-3f36ed4a242b\nstatus: experimental\ndescription: >-\n Detects svchost.exe executing from a path outside System32 or SysWOW64. The GOCLOUD\n cryptojacking toolkit renames its XMRig miner to svchost.exe and runs it from a\n TimeService folder under the user AppData tree, a masquerade legitimate Windows service\n host processes never perform.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.stealth\n - attack.t1036.005\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\svchost.exe'\n filter_main_legit_path:\n Image|contains:\n - ':\\Windows\\System32\\'\n - ':\\Windows\\SysWOW64\\'\n - ':\\Windows\\WinSxS\\'\n condition: selection and not filter_main_legit_path\nfalsepositives:\n - Third-party software that ships a bundled binary named svchost.exe outside the system tree\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f7d4ae9-b9bc-55be-a830-02ecbebcc3eb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.493936Z", "modified": "2026-07-27T01:08:14.493936Z", "name": "Defender Real-Time Monitoring Disabled With Exclusion Added", "indicator_types": [ "malicious-activity" ], "pattern": "title: Defender Real-Time Monitoring Disabled With Exclusion Added\nid: 11c51f72-48bd-43d5-9a5d-2d0da40f5ccf\nstatus: experimental\ndescription: >-\n Detects a PowerShell script block that both disables Windows Defender real-time monitoring\n and adds a scan exclusion path. The GOCLOUD Windows miner performs both actions before any\n payload download so the miner it drops is never scanned.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.defense-impairment\n - attack.t1685\nlogsource:\n category: ps_script\n product: windows\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection_disable:\n ScriptBlockText|contains: 'Set-MpPreference -DisableRealtimeMonitoring'\n selection_exclude:\n ScriptBlockText|contains: 'Add-MpPreference -ExclusionPath'\n condition: all of selection_*\nfalsepositives:\n - Endpoint-management scripts that intentionally reconfigure Defender\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ed8ccdde-637f-571a-9349-7c54001be07f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.494116Z", "modified": "2026-07-27T01:08:14.494116Z", "name": "Certutil Download Cradle Fetching Remote Payload", "indicator_types": [ "malicious-activity" ], "pattern": "title: Certutil Download Cradle Fetching Remote Payload\nid: 28a3b008-b1d3-4eab-bb33-d31c35e62973\nstatus: experimental\ndescription: >-\n Detects certutil.exe used as a download cradle with the urlcache and split flags to fetch\n a remote file over HTTP. The GOCLOUD Windows worm uses this to pull deploy.bat to the temp\n directory during WMI-based LAN propagation.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.command-and-control\n - attack.stealth\n - attack.t1105\n - attack.t1140\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\certutil.exe'\n - OriginalFileName: 'CertUtil.exe'\n selection_urlcache:\n CommandLine|contains:\n - '-urlcache'\n - '/urlcache'\n selection_split:\n CommandLine|contains:\n - '-split'\n - '/split'\n selection_http:\n CommandLine|contains: 'http'\n condition: selection_img and selection_urlcache and selection_split and selection_http\nfalsepositives:\n - Rare administrative use of certutil to retrieve certificate revocation data\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c96b1632-7109-53b3-9333-aae5c669cef7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.494306Z", "modified": "2026-07-27T01:08:14.494306Z", "name": "Remote Scheduled Task Creation Running As SYSTEM", "indicator_types": [ "malicious-activity" ], "pattern": "title: Remote Scheduled Task Creation Running As SYSTEM\nid: 95400021-9144-4baf-9e25-6519fe2ef868\nstatus: experimental\ndescription: >-\n Detects creation of a scheduled task on a remote host running as SYSTEM via schtasks with\n the remote server and run-as SYSTEM flags. The GOCLOUD Windows worm registers a SYSTEM task\n on each freshly reached LAN host and immediately runs it to spread the miner.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.execution\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1053.005\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\schtasks.exe'\n - OriginalFileName: 'schtasks.exe'\n selection_create:\n CommandLine|contains: '/create'\n selection_remote:\n CommandLine|contains: '/s '\n selection_system:\n CommandLine|contains: '/ru SYSTEM'\n condition: all of selection_*\nfalsepositives:\n - Enterprise administration tools that provision SYSTEM scheduled tasks on remote hosts\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--69624b26-ddb7-555a-a0dc-5cbfaf233859", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.494474Z", "modified": "2026-07-27T01:08:14.494474Z", "name": "Scheduled Task Registering SYSTEM Action In User AppData", "indicator_types": [ "malicious-activity" ], "pattern": "title: Scheduled Task Registering SYSTEM Action In User AppData\nid: ec66df96-4699-45b5-9edd-fbf21d195240\nstatus: experimental\ndescription: >-\n Detects schtasks creating a task whose action runs a binary under a user AppData path with\n SYSTEM privileges. The GOCLOUD miner persists as WindowsTimeSync or WindowsWatchdog pointing\n at a renamed XMRig under the AppData TimeService folder running as SYSTEM.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.execution\n - attack.persistence\n - attack.privilege-escalation\n - attack.stealth\n - attack.t1053.005\n - attack.t1036.005\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\schtasks.exe'\n - OriginalFileName: 'schtasks.exe'\n selection_create:\n CommandLine|contains: '/create'\n selection_action:\n CommandLine|contains:\n - '\\AppData\\'\n - '%APPDATA%'\n selection_system:\n CommandLine|contains: '/ru SYSTEM'\n condition: all of selection_*\nfalsepositives:\n - Unusual installers that register SYSTEM tasks pointing at per-user AppData paths\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2d02470b-a68c-532c-92f6-3ac09efc5dd2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.494633Z", "modified": "2026-07-27T01:08:14.494633Z", "name": "Process Executed From X11-Socket-Lookalike Temp Directory", "indicator_types": [ "malicious-activity" ], "pattern": "title: Process Executed From X11-Socket-Lookalike Temp Directory\nid: 03268048-2fb3-40e2-9c26-b3afd233005c\nstatus: experimental\ndescription: >-\n Detects a process executing from a /tmp/.X11-unix. directory carrying a random suffix.\n Legitimate X11 uses the exact directory name without a trailing dot and suffix, so the\n dot-suffixed variant is the GOCLOUD Linux miner hiding location for its XMRig binary.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.stealth\n - attack.impact\n - attack.t1564.001\n - attack.t1496.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|contains: '/tmp/.X11-unix.'\n condition: selection\nfalsepositives:\n - Unlikely; the standard X11 socket directory does not carry a dot suffix\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--54c6112b-8816-5781-986a-aff4b91f07eb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.494779Z", "modified": "2026-07-27T01:08:14.494779Z", "name": "Hidden And System Attributes Set On User AppData Path", "indicator_types": [ "malicious-activity" ], "pattern": "title: Hidden And System Attributes Set On User AppData Path\nid: c9ae87a9-4e58-4daf-8f9c-a8bd074d0510\nstatus: experimental\ndescription: >-\n Detects attrib.exe applying the hidden and system attributes to a path under the user\n AppData tree. The GOCLOUD miner conceals its dropped TimeService directory this way. Broad\n enough that it is intended for hunting rather than direct alerting.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.stealth\n - attack.t1564.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\attrib.exe'\n - OriginalFileName: 'ATTRIB.EXE'\n selection_hidden:\n CommandLine|contains: '+h'\n selection_system:\n CommandLine|contains: '+s'\n selection_path:\n CommandLine|contains: '\\AppData\\'\n condition: selection_img and selection_hidden and selection_system and selection_path\nfalsepositives:\n - Some legitimate applications hide per-user data directories\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--034f63c5-3132-5ce1-a5cb-b9d6698e5bfb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.494893Z", "modified": "2026-07-27T01:08:14.494893Z", "name": "Script Host Executing VBScript From Windows Temp", "indicator_types": [ "malicious-activity" ], "pattern": "title: Script Host Executing VBScript From Windows Temp\nid: 5a64b8ea-2ab7-49f8-a202-f4d3b9f2bbc6\nstatus: experimental\ndescription: >-\n Detects wscript.exe or cscript.exe running a VBScript from the Windows Temp folder or a\n public directory. The GOCLOUD worm launches worm.vbs from the Windows Temp folder for its\n subnet LAN sweep. Broad; intended for hunting.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.execution\n - attack.t1059.005\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\wscript.exe'\n - Image|endswith: '\\cscript.exe'\n selection_path:\n CommandLine|contains:\n - '\\Windows\\Temp\\'\n - '\\Users\\Public\\'\n selection_ext:\n CommandLine|contains: '.vbs'\n condition: all of selection_*\nfalsepositives:\n - Legitimate setup scripts staged in temporary directories\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a555180b-c1db-56b3-b785-b87da35394fa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495007Z", "modified": "2026-07-27T01:08:14.495007Z", "name": "Net Use Mapping Administrative Share With Explicit Credential", "indicator_types": [ "malicious-activity" ], "pattern": "title: Net Use Mapping Administrative Share With Explicit Credential\nid: 4e1b4b06-a18b-46f4-8eed-d1f7baf9e61e\nstatus: experimental\ndescription: >-\n Detects net.exe mapping an administrative share (C$, ADMIN$, IPC$) with an explicit\n credential. The GOCLOUD infect.ps1 and node-2 a.py probe test flat LANs for a shared\n blank-password local administrator before dropping the miner. Broad; intended for hunting.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.lateral-movement\n - attack.t1021.002\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\net.exe'\n - Image|endswith: '\\net1.exe'\n selection_use:\n CommandLine|contains: ' use '\n selection_share:\n CommandLine|contains:\n - 'C$'\n - 'ADMIN$'\n - 'IPC$'\n selection_cred:\n CommandLine|contains: '/u:'\n condition: all of selection_*\nfalsepositives:\n - Administrative scripts mapping admin shares for legitimate management\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b64fcb2d-57d7-5392-b7c7-49e11bc0216d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495121Z", "modified": "2026-07-27T01:08:14.495121Z", "name": "PowerShell IEX Download Cradle From Remote Host", "indicator_types": [ "malicious-activity" ], "pattern": "title: PowerShell IEX Download Cradle From Remote Host\nid: d8c4a085-a8d2-44ae-a76c-eb509ca19067\nstatus: experimental\ndescription: >-\n Detects a PowerShell download-and-execute cradle combining Invoke-Expression with a web\n request. The GOCLOUD one-click installer uses an iex plus Invoke-WebRequest cradle to pull\n and run allinone.ps1. Broad; intended for hunting.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.execution\n - attack.command-and-control\n - attack.t1059.001\n - attack.t1105\nlogsource:\n category: ps_script\n product: windows\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection_iex:\n ScriptBlockText|contains:\n - 'IEX '\n - 'Invoke-Expression'\n selection_web:\n ScriptBlockText|contains:\n - 'iwr '\n - 'Invoke-WebRequest'\n - 'DownloadString'\n condition: all of selection_*\nfalsepositives:\n - Provisioning scripts that fetch and run remote code\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d91192d9-30ee-5c28-b008-42e9f56f223f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495233Z", "modified": "2026-07-27T01:08:14.495233Z", "name": "Systemd Or Cron Executing Binary From Tmp", "indicator_types": [ "malicious-activity" ], "pattern": "title: Systemd Or Cron Executing Binary From Tmp\nid: db92c228-ae52-4960-9957-0a8474cdf072\nstatus: experimental\ndescription: >-\n Detects a process launched directly from /tmp by systemd or cron. The GOCLOUD Linux miner\n persists as a systemd unit and an @reboot crontab entry whose action points at an XMRig\n binary under /tmp. Broad; intended for hunting.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/\nauthor: The Hunters Ledger\ndate: 2026-07-26\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.impact\n - attack.t1543.002\n - attack.t1496.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n ParentImage|endswith:\n - '/systemd'\n - '/cron'\n - '/crond'\n Image|startswith: '/tmp/'\n condition: selection\nfalsepositives:\n - Some legitimate software executes helper binaries from /tmp\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b834d23-9a70-5d36-bf5e-1842912f2618", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495348Z", "modified": "2026-07-27T01:08:14.495348Z", "name": "THL HUNT GOCLOUD-Cryptojacking XMRig Deployment Heartbeat GET (Fixed Parameter Order to Payload Host)", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT GOCLOUD-Cryptojacking XMRig Deployment Heartbeat GET (Fixed Parameter Order to Payload Host)\"; flow:established,to_server; http.uri; content:\"/r?host=\"; startswith; nocase; content:\"&status=OK&ts=\"; distance:0; nocase; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000001; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-26, reference https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/;)", "pattern_type": "suricata", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d178d71c-8029-56f0-8ac9-a37f3a836dbf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.49546Z", "modified": "2026-07-27T01:08:14.49546Z", "name": "THL HUNT GOCLOUD-Cryptojacking XMRig Worker-Label Heartbeat (gocloud_ or winjenkins_ Naming Convention)", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT GOCLOUD-Cryptojacking XMRig Worker-Label Heartbeat (gocloud_ or winjenkins_ Naming Convention)\"; flow:established,to_server; http.uri; content:\"worker=\"; nocase; pcre:\"/worker=(gocloud|winjenkins)_/i\"; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000002; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-26, reference https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/;)", "pattern_type": "suricata", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f6fe3723-bb2d-56c7-ab13-4ae2d9a2a5d4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495573Z", "modified": "2026-07-27T01:08:14.495573Z", "name": "THL HUNT GOCLOUD-Cryptojacking LAN Lateral-Movement Report Banner (=== ATTACK === Cleartext to Operator)", "indicator_types": [ "malicious-activity" ], "pattern": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT GOCLOUD-Cryptojacking LAN Lateral-Movement Report Banner (=== ATTACK === Cleartext to Operator)\"; flow:established,to_server; content:\"=== ATTACK ===\"; content:\"OK!\"; distance:0; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000003; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-26, reference https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/;)", "pattern_type": "suricata", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e43341c8-6d6b-5d5d-9af7-3971faef1e0b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495686Z", "modified": "2026-07-27T01:08:14.495686Z", "name": "THL HUNT GOCLOUD-Cryptojacking Windows Worm Component Retrieval (worm.vbs over HTTP)", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT GOCLOUD-Cryptojacking Windows Worm Component Retrieval (worm.vbs over HTTP)\"; flow:established,to_server; http.uri; content:\"worm.vbs\"; endswith; nocase; classtype:trojan-activity; sid:1000004; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-26, reference https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/;)", "pattern_type": "suricata", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7f568619-17e8-5781-a73b-30e61042eb4e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495799Z", "modified": "2026-07-27T01:08:14.495799Z", "name": "THL HUNT GOCLOUD-Cryptojacking Linux Miner Delivery One-Liner (miner.sh Piped To Bash)", "indicator_types": [ "malicious-activity" ], "pattern": "alert tcp any any -> any any (msg:\"THL HUNT GOCLOUD-Cryptojacking Linux Miner Delivery One-Liner (miner.sh Piped To Bash)\"; flow:established; content:\"miner.sh|7c|bash\"; nocase; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000005; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-26, reference https://the-hunters-ledger.com/hunting-detections/gocloud-multiservice-cryptojacking-149-28-112-221-detections/;)", "pattern_type": "suricata", "valid_from": "2026-07-26T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.495931Z", "modified": "2026-07-27T01:08:14.495931Z", "name": "XMRig", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496079Z", "modified": "2026-07-27T01:08:14.496079Z", "name": "GOCLOUD", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.49622Z", "modified": "2026-07-27T01:08:14.49622Z", "name": "OmniHunter", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--64a34cd2-5302-5a5a-9ff0-4c86e53b1528", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496374Z", "modified": "2026-07-27T01:08:14.496374Z", "name": "batch_exploit.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--fccad669-7f51-5f32-962d-9ad2db5848b1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496489Z", "modified": "2026-07-27T01:08:14.496489Z", "name": "fofa_batch.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--aba2a464-e2cd-5689-90ce-5f7dc1c803d8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496583Z", "modified": "2026-07-27T01:08:14.496583Z", "name": "add_log4spring_to_batch.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--1ce3162d-e168-55cf-a77e-ea31b270c8dc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496674Z", "modified": "2026-07-27T01:08:14.496674Z", "name": "add_oa_funcs.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--469cd010-0062-59c9-9fc8-f32e14c8113b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496766Z", "modified": "2026-07-27T01:08:14.496766Z", "name": "append_part.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--e922212d-ad07-5691-ba4f-6e8732f05d7c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496855Z", "modified": "2026-07-27T01:08:14.496855Z", "name": "loop_batch.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--28b6c08f-ec19-52af-bbc6-323022290344", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.496945Z", "modified": "2026-07-27T01:08:14.496945Z", "name": "fix_fofa.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--65056a35-8395-500b-b4b4-e18c583cc662", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497034Z", "modified": "2026-07-27T01:08:14.497034Z", "name": "fix_fofa2.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--f1e0485e-29a6-584d-89dc-12506a23cfaf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497124Z", "modified": "2026-07-27T01:08:14.497124Z", "name": "inject_fofa.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--caca3d01-9c70-59f4-a0c9-0a51e6b85a48", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497213Z", "modified": "2026-07-27T01:08:14.497213Z", "name": "exploit_runner.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a219883e-344b-5bba-8a47-e4e705dbe405", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497301Z", "modified": "2026-07-27T01:08:14.497301Z", "name": "exploit_v2.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--2a1646c2-9dc1-5357-98d7-9379fc8b4f34", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.49739Z", "modified": "2026-07-27T01:08:14.49739Z", "name": "exploit_v3.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--520d1984-695b-51ce-b00a-3e3135c35cd8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497478Z", "modified": "2026-07-27T01:08:14.497478Z", "name": "re_exploit.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--df0f8d62-a1bc-5461-b9e7-46d95e61cfd9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497567Z", "modified": "2026-07-27T01:08:14.497567Z", "name": "redrop.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--5a2d92d0-087b-541c-82a5-15581b72a481", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497654Z", "modified": "2026-07-27T01:08:14.497654Z", "name": "insert_zero.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--8cc40458-014d-5002-a2c5-55c1f5d3cc18", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497743Z", "modified": "2026-07-27T01:08:14.497743Z", "name": "zero_day_extras.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--7d3a3c89-07ac-5bfe-831d-2b1a1d327ab7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.49783Z", "modified": "2026-07-27T01:08:14.49783Z", "name": "report_server.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--5486332c-9401-5bc4-a162-e9f49598ef32", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.497918Z", "modified": "2026-07-27T01:08:14.497918Z", "name": "run_report.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--21894871-ad5b-5623-b92c-7b412e83f3b4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498005Z", "modified": "2026-07-27T01:08:14.498005Z", "name": "report_miner.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--f6338217-0ec1-57c0-9aed-6cc872b42878", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498093Z", "modified": "2026-07-27T01:08:14.498093Z", "name": "probe_target.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a60085d8-c069-5b64-8f6f-6f9ab8001b67", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498183Z", "modified": "2026-07-27T01:08:14.498183Z", "name": "scanner.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--c72addcc-ebc0-5507-b571-fb3eb42c226f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498272Z", "modified": "2026-07-27T01:08:14.498272Z", "name": "loop_scan.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--42f9a4f6-47f8-58c9-9611-67ad0e1f36fd", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498361Z", "modified": "2026-07-27T01:08:14.498361Z", "name": "watchdog2.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--cd537e09-2c05-5363-aca8-9815db855b0a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498449Z", "modified": "2026-07-27T01:08:14.498449Z", "name": "log4j_listener.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--5a31e7dd-678b-5b19-9d7d-883cc6d7aae2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498546Z", "modified": "2026-07-27T01:08:14.498546Z", "name": "setup.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--18d4b1be-01f3-5fca-b823-ae658bb39c7f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498634Z", "modified": "2026-07-27T01:08:14.498634Z", "name": "fix_vultr.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--0266b609-212c-51c3-8cd3-b86076fb1928", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498723Z", "modified": "2026-07-27T01:08:14.498723Z", "name": "vultr_miner_serve.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a0463eb4-115b-5f75-bd64-dfef32e5b594", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498811Z", "modified": "2026-07-27T01:08:14.498811Z", "name": "deploy_v3.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--35ecda6c-00db-5ad3-accd-053e177c9c35", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.4989Z", "modified": "2026-07-27T01:08:14.4989Z", "name": "upgrade_v31.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--3131185c-24a9-5f4b-9e48-23643bc13f31", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.498988Z", "modified": "2026-07-27T01:08:14.498988Z", "name": "winminer.ps1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--e2e52ae2-2634-51f4-b55d-87db31b69c0f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499076Z", "modified": "2026-07-27T01:08:14.499076Z", "name": "miner.sh", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--f4ae2117-1ef9-523b-8a77-234922b170b2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499165Z", "modified": "2026-07-27T01:08:14.499165Z", "name": "config.json", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--b2e52178-3dd8-52d5-930a-696ca5278cba", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499264Z", "modified": "2026-07-27T01:08:14.499264Z", "name": "deploy.ps1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--6731a2b5-ad6c-5729-b1fb-6ca9022acd90", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499411Z", "modified": "2026-07-27T01:08:14.499411Z", "name": "allinone.ps1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--db53095e-2d64-52d2-9215-517845954f76", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499557Z", "modified": "2026-07-27T01:08:14.499557Z", "name": "setup.bat", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--120e1be8-66e7-513a-808f-419e97003772", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499697Z", "modified": "2026-07-27T01:08:14.499697Z", "name": "infect.ps1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--9871b17b-c8a9-5f31-aafb-a889c677b281", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.499847Z", "modified": "2026-07-27T01:08:14.499847Z", "name": "omnihunter.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--bb7e063d-937f-52e0-8c59-3be4134985e1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.49998Z", "modified": "2026-07-27T01:08:14.49998Z", "name": "listener2.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--f5e0cd61-3454-5894-9856-b5c01f1f464c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50013Z", "modified": "2026-07-27T01:08:14.50013Z", "name": "a.py", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--01bad0ab-9f55-51f1-8b5c-2b414b172714", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.500278Z", "modified": "2026-07-27T01:08:14.500278Z", "name": "xmrig.exe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a544493e-970f-5e1f-921a-48ff5adc5735", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.500422Z", "modified": "2026-07-27T01:08:14.500422Z", "name": "WinRing0x64.sys", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a20b1e42-ab5e-5e85-866a-e1160c02ed85", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.500654Z", "modified": "2026-07-27T01:08:14.500654Z", "name": "authorized_keys", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4f83db55-e9f1-5071-aef3-ab98216b533a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.500789Z", "modified": "2026-07-27T01:08:14.500789Z", "name": "Vulnerability Scanning", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1595/002", "external_id": "T1595.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7117772d-e0a9-526c-9a08-e1392a460b46", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501018Z", "modified": "2026-07-27T01:08:14.501018Z", "name": "Scan Databases (FOFA)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1596/005", "external_id": "T1596.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50115Z", "modified": "2026-07-27T01:08:14.50115Z", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190", "external_id": "T1190" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4efef37e-c256-5987-a1b8-60d9424c7250", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501274Z", "modified": "2026-07-27T01:08:14.501274Z", "name": "Default Accounts", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1078/001", "external_id": "T1078.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501392Z", "modified": "2026-07-27T01:08:14.501392Z", "name": "Python", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/006", "external_id": "T1059.006" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501513Z", "modified": "2026-07-27T01:08:14.501513Z", "name": "PowerShell", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/001", "external_id": "T1059.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501628Z", "modified": "2026-07-27T01:08:14.501628Z", "name": "Visual Basic", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1059/005", "external_id": "T1059.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--43404a42-9dbf-5b19-a941-1fae6c633dfe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501743Z", "modified": "2026-07-27T01:08:14.501743Z", "name": "Windows Management Instrumentation", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1047", "external_id": "T1047" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1635f86c-b5b5-5339-b31b-87ce05013408", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501856Z", "modified": "2026-07-27T01:08:14.501856Z", "name": "Cron", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1053/003", "external_id": "T1053.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.501971Z", "modified": "2026-07-27T01:08:14.501971Z", "name": "Scheduled Task", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1053/005", "external_id": "T1053.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ef3ac7d9-a40e-539b-9435-17e7305a5bb8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.502088Z", "modified": "2026-07-27T01:08:14.502088Z", "name": "Systemd Service", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1543/002", "external_id": "T1543.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.502203Z", "modified": "2026-07-27T01:08:14.502203Z", "name": "Registry Run Keys", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/001", "external_id": "T1547.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.502316Z", "modified": "2026-07-27T01:08:14.502316Z", "name": "Disable or Modify Tools", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1562/001", "external_id": "T1562.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50243Z", "modified": "2026-07-27T01:08:14.50243Z", "name": "Match Legitimate Name or Location", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1036/005", "external_id": "T1036.005" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ae605b9d-aec8-5001-87c6-c60e0a234712", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.502553Z", "modified": "2026-07-27T01:08:14.502553Z", "name": "Hidden Files and Directories", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1564/001", "external_id": "T1564.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.502667Z", "modified": "2026-07-27T01:08:14.502667Z", "name": "SMB / Windows Admin Shares", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1021/002", "external_id": "T1021.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f581a47e-a604-559a-95cf-25f070a98c95", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.502784Z", "modified": "2026-07-27T01:08:14.502784Z", "name": "Lateral Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1570", "external_id": "T1570" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.5029Z", "modified": "2026-07-27T01:08:14.5029Z", "name": "Web Protocols", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1071/001", "external_id": "T1071.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.503014Z", "modified": "2026-07-27T01:08:14.503014Z", "name": "Ingress Tool Transfer", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1105", "external_id": "T1105" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.503128Z", "modified": "2026-07-27T01:08:14.503128Z", "name": "Non-Standard Port", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1571", "external_id": "T1571" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6036def8-6bae-5d6e-b2e5-4e5f8419e3ac", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.503241Z", "modified": "2026-07-27T01:08:14.503241Z", "name": "Compute Hijacking", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1496/001", "external_id": "T1496.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--786f5ee4-f1f0-559b-9cb4-541a82a9ac3d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.503366Z", "modified": "2026-07-27T01:08:14.503366Z", "name": "gocloud-multiservice-cryptojacking-149-28-112-221 infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d910e8b9-3154-51d6-bf1c-cf8f2611357d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50375Z", "modified": "2026-07-27T01:08:14.50375Z", "name": "CVE-2022-26134", "external_references": [ { "source_name": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26134", "external_id": "CVE-2022-26134" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--1d094909-f151-5c5f-be97-7b0512521de3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.503878Z", "modified": "2026-07-27T01:08:14.503878Z", "name": "CVE-2023-38646", "external_references": [ { "source_name": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38646", "external_id": "CVE-2023-38646" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db27553e-d985-5f68-88b9-7a6dacc7b846", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.504423Z", "modified": "2026-07-27T01:08:14.504423Z", "relationship_type": "indicates", "source_ref": "indicator--062fdbcf-73ce-56c8-abb2-1031444f5507", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--34ed229b-0c95-5802-a856-f66caf7602c0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.504542Z", "modified": "2026-07-27T01:08:14.504542Z", "relationship_type": "indicates", "source_ref": "indicator--ebacba11-f06a-5b8e-a4f4-86a52ea8796e", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05dee4ab-65b7-543b-be3c-77653b1f6ac8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.504643Z", "modified": "2026-07-27T01:08:14.504643Z", "relationship_type": "indicates", "source_ref": "indicator--6d6c54df-04a6-5c52-8ad3-736345eef715", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ecb483e-a1eb-5640-b3a5-7e2309e93c35", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.504741Z", "modified": "2026-07-27T01:08:14.504741Z", "relationship_type": "indicates", "source_ref": "indicator--789e9b4c-8105-5f2d-a1c4-ae7750a15876", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7088183f-fe94-58ab-860c-0e0d91f6c7e8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.504836Z", "modified": "2026-07-27T01:08:14.504836Z", "relationship_type": "indicates", "source_ref": "indicator--8b13c7e4-d123-54b8-a378-c42be0ea2487", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80220add-3ade-5546-b4fc-cbf187696062", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.504931Z", "modified": "2026-07-27T01:08:14.504931Z", "relationship_type": "indicates", "source_ref": "indicator--f0625c74-2d57-5795-a2bf-6dbc60dd3711", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23f7532b-cd63-56e2-a2a1-8545f520b3da", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505027Z", "modified": "2026-07-27T01:08:14.505027Z", "relationship_type": "indicates", "source_ref": "indicator--bfdfee33-a0c0-5ab9-8dae-fb2fb3e6dda0", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f31fe43f-a43d-521e-98e8-08d73dacf1e8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505121Z", "modified": "2026-07-27T01:08:14.505121Z", "relationship_type": "indicates", "source_ref": "indicator--01a00eee-856e-59b9-a983-d58010a28943", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6107d98-794c-5097-a902-c2a77f299d47", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505215Z", "modified": "2026-07-27T01:08:14.505215Z", "relationship_type": "indicates", "source_ref": "indicator--416d8066-9af3-5e3a-873b-1ffeeec7e4f8", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e2d7dc2b-5027-597f-9545-adfb80c9fbea", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505319Z", "modified": "2026-07-27T01:08:14.505319Z", "relationship_type": "indicates", "source_ref": "indicator--da672148-f496-50d3-bf8e-cb66fab40052", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0842771c-0c50-59ce-a131-2294f9f4a96b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505441Z", "modified": "2026-07-27T01:08:14.505441Z", "relationship_type": "indicates", "source_ref": "indicator--d745861e-9414-5de2-a87b-9d213438492b", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ece96cf8-9102-5117-a882-2d1a13a6040f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505593Z", "modified": "2026-07-27T01:08:14.505593Z", "relationship_type": "indicates", "source_ref": "indicator--4ba05cb5-2063-59d1-8c76-2a9f0848f359", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26ad510a-c5ee-5234-a8aa-77198134d72d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505698Z", "modified": "2026-07-27T01:08:14.505698Z", "relationship_type": "indicates", "source_ref": "indicator--5f26c492-8724-512d-a7ad-44db108d7668", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07f87e54-1218-5ffe-91a3-7eba0601a48a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.505974Z", "modified": "2026-07-27T01:08:14.505974Z", "relationship_type": "indicates", "source_ref": "indicator--d4d07e30-7e3f-5666-9f5e-6e5c935ddc7d", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--67bc64aa-d354-5afc-80a5-4f55483536f5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506111Z", "modified": "2026-07-27T01:08:14.506111Z", "relationship_type": "indicates", "source_ref": "indicator--e36f27e6-ae4b-5f74-8405-1d929be77cc6", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb35ef06-e2c4-5157-8cd2-e79c99aca1f2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506231Z", "modified": "2026-07-27T01:08:14.506231Z", "relationship_type": "indicates", "source_ref": "indicator--fd2f5b58-8411-5874-a9a3-fe8d5f1271a5", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1d7cce1-1afd-5931-9bb9-5cc28c791793", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506358Z", "modified": "2026-07-27T01:08:14.506358Z", "relationship_type": "indicates", "source_ref": "indicator--168dc883-1d93-5ba9-bad9-937122a62137", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc6c9080-0ba1-5e42-8014-5122abf5533e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506494Z", "modified": "2026-07-27T01:08:14.506494Z", "relationship_type": "indicates", "source_ref": "indicator--2499b0e1-3893-5e8d-a19c-fb3791f619bb", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--88c4f3fa-e70e-5bb4-80b0-d7f4402d4454", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506631Z", "modified": "2026-07-27T01:08:14.506631Z", "relationship_type": "indicates", "source_ref": "indicator--ca3de1fd-2477-5cf5-82ea-90a25897c375", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f79f2e53-94a9-5a06-8bba-7ff8853bc735", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506737Z", "modified": "2026-07-27T01:08:14.506737Z", "relationship_type": "indicates", "source_ref": "indicator--25efeb92-5d0d-5adc-93ac-6e35a3c8578a", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62a77a0a-d8a3-5c48-b54f-a028466f5b57", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506842Z", "modified": "2026-07-27T01:08:14.506842Z", "relationship_type": "indicates", "source_ref": "indicator--d36c8055-09c3-5542-a8f8-653728f43ca4", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f398c6e4-55b0-582d-94c2-edc6f905eb28", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.506936Z", "modified": "2026-07-27T01:08:14.506936Z", "relationship_type": "indicates", "source_ref": "indicator--e686fb10-dd74-5606-9ae8-74c768796823", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e79e5138-e385-534c-8291-2b37787e17af", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50703Z", "modified": "2026-07-27T01:08:14.50703Z", "relationship_type": "indicates", "source_ref": "indicator--b449a6e9-9f27-5a0e-8ddf-5934bf3e6321", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--46f66bd9-a50d-5ab4-94af-2698b93d7a2a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507124Z", "modified": "2026-07-27T01:08:14.507124Z", "relationship_type": "indicates", "source_ref": "indicator--0f7d4ae9-b9bc-55be-a830-02ecbebcc3eb", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33a0a865-bc2e-551b-9155-e9e8567aa6aa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507218Z", "modified": "2026-07-27T01:08:14.507218Z", "relationship_type": "indicates", "source_ref": "indicator--ed8ccdde-637f-571a-9349-7c54001be07f", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23b41aac-4cb0-5e28-9938-3f39db9138c9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507313Z", "modified": "2026-07-27T01:08:14.507313Z", "relationship_type": "indicates", "source_ref": "indicator--c96b1632-7109-53b3-9333-aae5c669cef7", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5cceca8d-eb0b-5674-97f7-57e16b232280", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507407Z", "modified": "2026-07-27T01:08:14.507407Z", "relationship_type": "indicates", "source_ref": "indicator--69624b26-ddb7-555a-a0dc-5cbfaf233859", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2300c53c-d443-5389-894d-986506a0d2bf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507501Z", "modified": "2026-07-27T01:08:14.507501Z", "relationship_type": "indicates", "source_ref": "indicator--2d02470b-a68c-532c-92f6-3ac09efc5dd2", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49e7a099-bb2c-51d1-bb29-3aee2fed08f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507595Z", "modified": "2026-07-27T01:08:14.507595Z", "relationship_type": "indicates", "source_ref": "indicator--54c6112b-8816-5781-986a-aff4b91f07eb", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2f3c94e-2191-58b4-acbf-e52b83c60313", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507689Z", "modified": "2026-07-27T01:08:14.507689Z", "relationship_type": "indicates", "source_ref": "indicator--034f63c5-3132-5ce1-a5cb-b9d6698e5bfb", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4b6553af-82a6-529a-b2de-7c3e73684020", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507782Z", "modified": "2026-07-27T01:08:14.507782Z", "relationship_type": "indicates", "source_ref": "indicator--a555180b-c1db-56b3-b785-b87da35394fa", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24fa2c7f-a4b6-52ca-8b00-e0ce85e714ed", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507882Z", "modified": "2026-07-27T01:08:14.507882Z", "relationship_type": "indicates", "source_ref": "indicator--b64fcb2d-57d7-5392-b7c7-49e11bc0216d", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--59a12dd8-fa60-59d0-9709-c1432aa21bf0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.507975Z", "modified": "2026-07-27T01:08:14.507975Z", "relationship_type": "indicates", "source_ref": "indicator--d91192d9-30ee-5c28-b008-42e9f56f223f", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5971035e-f698-5e5c-aeab-ed0c62390381", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50807Z", "modified": "2026-07-27T01:08:14.50807Z", "relationship_type": "indicates", "source_ref": "indicator--5b834d23-9a70-5d36-bf5e-1842912f2618", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--346e5fe5-6ced-5d2e-9f3d-66fb94efca1f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508165Z", "modified": "2026-07-27T01:08:14.508165Z", "relationship_type": "indicates", "source_ref": "indicator--d178d71c-8029-56f0-8ac9-a37f3a836dbf", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d64333ff-ab08-5b22-8cea-d6579ab0e39e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508258Z", "modified": "2026-07-27T01:08:14.508258Z", "relationship_type": "indicates", "source_ref": "indicator--f6fe3723-bb2d-56c7-ab13-4ae2d9a2a5d4", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f50e6f32-27d2-5054-b7aa-a023af486a2f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508351Z", "modified": "2026-07-27T01:08:14.508351Z", "relationship_type": "indicates", "source_ref": "indicator--e43341c8-6d6b-5d5d-9af7-3971faef1e0b", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ff2d1dd-f8f7-5436-8adb-88b7e18d417f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508445Z", "modified": "2026-07-27T01:08:14.508445Z", "relationship_type": "indicates", "source_ref": "indicator--7f568619-17e8-5781-a73b-30e61042eb4e", "target_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--264b406a-798b-54aa-b601-b5efbc393127", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508544Z", "modified": "2026-07-27T01:08:14.508544Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--4f83db55-e9f1-5071-aef3-ab98216b533a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1901a592-7212-5e82-aa30-b453af19f4cf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508639Z", "modified": "2026-07-27T01:08:14.508639Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--7117772d-e0a9-526c-9a08-e1392a460b46", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fdcb6a91-2bc0-5d16-9b73-b608e0fcd05b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508735Z", "modified": "2026-07-27T01:08:14.508735Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3451cea5-9e8e-535a-919e-bc907930c90e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.50883Z", "modified": "2026-07-27T01:08:14.50883Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--4efef37e-c256-5987-a1b8-60d9424c7250", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60e7843a-2dbf-533a-93ee-eb16d870ec7f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.508923Z", "modified": "2026-07-27T01:08:14.508923Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e803f90-32c1-58c0-b791-793f1269a797", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509021Z", "modified": "2026-07-27T01:08:14.509021Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2d57cadd-80ef-5b14-86dc-35dca0555c4c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509116Z", "modified": "2026-07-27T01:08:14.509116Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--160fb2b6-89e1-574e-9a25-4c3295819f9d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509209Z", "modified": "2026-07-27T01:08:14.509209Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--43404a42-9dbf-5b19-a941-1fae6c633dfe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ef7c769-b100-5b97-94dc-e4ac439219a0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509301Z", "modified": "2026-07-27T01:08:14.509301Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--1635f86c-b5b5-5339-b31b-87ce05013408", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4b6a8371-c354-5f5d-bc3b-a66c07e6fdee", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509394Z", "modified": "2026-07-27T01:08:14.509394Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2e2d500-8534-5d85-a063-6ba97adcfe85", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509487Z", "modified": "2026-07-27T01:08:14.509487Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--ef3ac7d9-a40e-539b-9435-17e7305a5bb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee18f83a-0d67-5d91-a4d1-9e0b1b29b31d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509582Z", "modified": "2026-07-27T01:08:14.509582Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6e490e7-9a78-5d90-9325-90d96a1395c1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509679Z", "modified": "2026-07-27T01:08:14.509679Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eed7c904-bd87-55d0-b2dc-65852f464a58", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509772Z", "modified": "2026-07-27T01:08:14.509772Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e058a03b-6c26-507c-9652-fed3c570e748", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509867Z", "modified": "2026-07-27T01:08:14.509867Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--ae605b9d-aec8-5001-87c6-c60e0a234712", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80f8337e-3755-564a-a003-84c8e47591f1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.509961Z", "modified": "2026-07-27T01:08:14.509961Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df919a44-f2ea-5aa3-9970-9bf6e5708417", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510056Z", "modified": "2026-07-27T01:08:14.510056Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--f581a47e-a604-559a-95cf-25f070a98c95", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--595ac730-1966-5b33-b217-3d7f3788f779", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51015Z", "modified": "2026-07-27T01:08:14.51015Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02d76b35-1f68-5014-9ffe-4ca5c6b4becf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510243Z", "modified": "2026-07-27T01:08:14.510243Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ddae8b34-1278-521a-bc93-5dd5ad62d73d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510337Z", "modified": "2026-07-27T01:08:14.510337Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb33bf1f-09b3-503f-882c-53dce212bc3c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510432Z", "modified": "2026-07-27T01:08:14.510432Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "attack-pattern--6036def8-6bae-5d6e-b2e5-4e5f8419e3ac", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9abf94a1-345a-5efc-93c5-9bd1f6f86264", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510534Z", "modified": "2026-07-27T01:08:14.510534Z", "relationship_type": "uses", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "infrastructure--786f5ee4-f1f0-559b-9cb4-541a82a9ac3d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5461aa3-c4fd-5708-90ec-5e7bf9f3faae", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510632Z", "modified": "2026-07-27T01:08:14.510632Z", "relationship_type": "exploits", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "vulnerability--d910e8b9-3154-51d6-bf1c-cf8f2611357d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4876feaa-bba3-56f2-a675-2cef86e923f9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510726Z", "modified": "2026-07-27T01:08:14.510726Z", "relationship_type": "exploits", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "vulnerability--1d094909-f151-5c5f-be97-7b0512521de3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d2fb29f-3c62-5d64-b102-707630cdb1f0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510822Z", "modified": "2026-07-27T01:08:14.510822Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--4f83db55-e9f1-5071-aef3-ab98216b533a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b223fa2e-4bcf-5be3-8f05-ea70fbdb48f2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.510916Z", "modified": "2026-07-27T01:08:14.510916Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--7117772d-e0a9-526c-9a08-e1392a460b46", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d320cdff-9e68-58bc-8ee7-36558d52fda3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51101Z", "modified": "2026-07-27T01:08:14.51101Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ddccda51-b4a7-53c2-a57d-b65d492fda3a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.511177Z", "modified": "2026-07-27T01:08:14.511177Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--4efef37e-c256-5987-a1b8-60d9424c7250", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f337a51f-f2bc-5ba0-a86d-5072d36a809a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51154Z", "modified": "2026-07-27T01:08:14.51154Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9522cd58-84bf-58ec-8b70-0bc654cece07", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.511724Z", "modified": "2026-07-27T01:08:14.511724Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--765bc371-8d45-5027-84b6-8aa5646104b5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.511952Z", "modified": "2026-07-27T01:08:14.511952Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c5eebf64-b691-5648-99b2-c5339a62211c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.512269Z", "modified": "2026-07-27T01:08:14.512269Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--43404a42-9dbf-5b19-a941-1fae6c633dfe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--abfc1ad1-13a3-5503-8070-0d2383df46e0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.512552Z", "modified": "2026-07-27T01:08:14.512552Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--1635f86c-b5b5-5339-b31b-87ce05013408", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b867f010-0988-59a3-8121-75270318240c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.512906Z", "modified": "2026-07-27T01:08:14.512906Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d2f6e86-60e6-5367-9494-5e4c6f607aba", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513054Z", "modified": "2026-07-27T01:08:14.513054Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--ef3ac7d9-a40e-539b-9435-17e7305a5bb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec36935b-65c1-57c7-bfe9-1c8b172a5f56", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513242Z", "modified": "2026-07-27T01:08:14.513242Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa953146-4a2e-5618-a5ef-d88c502f64b3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513377Z", "modified": "2026-07-27T01:08:14.513377Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--68509ca9-5cd6-5a11-ab7c-7302f0e03f5f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513479Z", "modified": "2026-07-27T01:08:14.513479Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b4a3f5c2-6eea-511c-bd5a-d939125f0749", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513581Z", "modified": "2026-07-27T01:08:14.513581Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--ae605b9d-aec8-5001-87c6-c60e0a234712", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--296ebb31-1b36-5326-a2b4-6191e4b169d7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513684Z", "modified": "2026-07-27T01:08:14.513684Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--197df16f-0bbe-5c17-be1c-9a3e2f8c4e6d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51379Z", "modified": "2026-07-27T01:08:14.51379Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--f581a47e-a604-559a-95cf-25f070a98c95", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ce3b834-21dc-5218-853e-e1a6c2eccc41", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513897Z", "modified": "2026-07-27T01:08:14.513897Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3b836610-1ef5-5930-a10f-f32d0eec5911", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.513998Z", "modified": "2026-07-27T01:08:14.513998Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--778dcf5f-910d-59dd-b200-3e54c4294773", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514096Z", "modified": "2026-07-27T01:08:14.514096Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--373396e2-7ba2-57bb-8caa-08f6094e6e80", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514196Z", "modified": "2026-07-27T01:08:14.514196Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "attack-pattern--6036def8-6bae-5d6e-b2e5-4e5f8419e3ac", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3872246-e300-5f94-abbe-48d7b264c9f3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514314Z", "modified": "2026-07-27T01:08:14.514314Z", "relationship_type": "uses", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "infrastructure--786f5ee4-f1f0-559b-9cb4-541a82a9ac3d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dccaf3c9-68fe-5516-ba4e-187bde66a892", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514415Z", "modified": "2026-07-27T01:08:14.514415Z", "relationship_type": "exploits", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "vulnerability--d910e8b9-3154-51d6-bf1c-cf8f2611357d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5cab3fd-3d37-5cd3-8ce5-46c0752e6615", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514513Z", "modified": "2026-07-27T01:08:14.514513Z", "relationship_type": "exploits", "source_ref": "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "target_ref": "vulnerability--1d094909-f151-5c5f-be97-7b0512521de3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--827258fa-2057-56b3-b243-754ce0996788", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514609Z", "modified": "2026-07-27T01:08:14.514609Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--4f83db55-e9f1-5071-aef3-ab98216b533a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93bccbb5-4583-5e93-be82-3d00d0c8c9a1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514708Z", "modified": "2026-07-27T01:08:14.514708Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--7117772d-e0a9-526c-9a08-e1392a460b46", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c38ac1f7-96fe-574f-9c6b-dd0da3eb5e4f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514804Z", "modified": "2026-07-27T01:08:14.514804Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--452392d6-e5e2-5b83-9511-601026b210af", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514898Z", "modified": "2026-07-27T01:08:14.514898Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--4efef37e-c256-5987-a1b8-60d9424c7250", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6f8daa1-0d37-5c89-99a7-87d0baba784c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.514995Z", "modified": "2026-07-27T01:08:14.514995Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--09c4b9d5-5e59-58e3-9b71-516ec5c4f134", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515095Z", "modified": "2026-07-27T01:08:14.515095Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--83c16930-8f88-5a6f-b797-ef7ae26e612c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515195Z", "modified": "2026-07-27T01:08:14.515195Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8a7a9eb0-25d5-5c7a-9c7c-c827a88cf9df", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51529Z", "modified": "2026-07-27T01:08:14.51529Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--43404a42-9dbf-5b19-a941-1fae6c633dfe", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9df98fb0-3068-5367-9b42-0a5c3fdc59a3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515386Z", "modified": "2026-07-27T01:08:14.515386Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--1635f86c-b5b5-5339-b31b-87ce05013408", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd9657d6-1212-57eb-aa54-315901628d63", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51548Z", "modified": "2026-07-27T01:08:14.51548Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f1b8d9c-6696-5822-842b-47898205db2c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515574Z", "modified": "2026-07-27T01:08:14.515574Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--ef3ac7d9-a40e-539b-9435-17e7305a5bb8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--42e2a320-9ba1-5c65-aa9c-a0d85701cbc0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515671Z", "modified": "2026-07-27T01:08:14.515671Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1d423ada-a517-5b58-82ea-425459d98e10", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515765Z", "modified": "2026-07-27T01:08:14.515765Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--323c6349-0ece-55e8-b1ab-33021f0bd375", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515858Z", "modified": "2026-07-27T01:08:14.515858Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f0a49d80-b67e-52f8-bb89-c831a6696715", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.515954Z", "modified": "2026-07-27T01:08:14.515954Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--ae605b9d-aec8-5001-87c6-c60e0a234712", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--27e77843-1b45-53d3-a9f4-c749b81ad4f1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51605Z", "modified": "2026-07-27T01:08:14.51605Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51ff09d2-8c74-509d-b49a-93d7474b7f04", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51618Z", "modified": "2026-07-27T01:08:14.51618Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--f581a47e-a604-559a-95cf-25f070a98c95", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cc37c297-6b2e-5b28-a92f-f66b1caf1cb2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.516276Z", "modified": "2026-07-27T01:08:14.516276Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05988263-2442-5442-85bd-d8afd87f1e4a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.516379Z", "modified": "2026-07-27T01:08:14.516379Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--95877d2f-8df5-5438-995e-ee656a046898", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.516474Z", "modified": "2026-07-27T01:08:14.516474Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9a1c8b3-3e9d-5b1e-81c5-cc662e2eecf0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.516571Z", "modified": "2026-07-27T01:08:14.516571Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "attack-pattern--6036def8-6bae-5d6e-b2e5-4e5f8419e3ac", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e9650ca-e779-5f97-a2c1-bae199447bf1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.516666Z", "modified": "2026-07-27T01:08:14.516666Z", "relationship_type": "uses", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "infrastructure--786f5ee4-f1f0-559b-9cb4-541a82a9ac3d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e263af5-e571-5d1a-bad6-141df635f0c5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.516764Z", "modified": "2026-07-27T01:08:14.516764Z", "relationship_type": "exploits", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "vulnerability--d910e8b9-3154-51d6-bf1c-cf8f2611357d", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6bea67d-af9e-5c05-bcef-c2d6fc69eceb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51686Z", "modified": "2026-07-27T01:08:14.51686Z", "relationship_type": "exploits", "source_ref": "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "target_ref": "vulnerability--1d094909-f151-5c5f-be97-7b0512521de3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dae5c842-d8b2-5eda-a07f-174f426ad84d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51696Z", "modified": "2026-07-27T01:08:14.51696Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--64a34cd2-5302-5a5a-9ff0-4c86e53b1528", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c9902469-a14c-54c8-b38a-e37259415cfc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51706Z", "modified": "2026-07-27T01:08:14.51706Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--fccad669-7f51-5f32-962d-9ad2db5848b1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bfeeea9e-1b64-5e73-8626-f201c8b6312c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517157Z", "modified": "2026-07-27T01:08:14.517157Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--aba2a464-e2cd-5689-90ce-5f7dc1c803d8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49e93cce-ef26-5321-842c-aad013860d22", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517254Z", "modified": "2026-07-27T01:08:14.517254Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--1ce3162d-e168-55cf-a77e-ea31b270c8dc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--276c9d6c-d8d0-5aba-8bac-f680ea0ab4d3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517348Z", "modified": "2026-07-27T01:08:14.517348Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--469cd010-0062-59c9-9fc8-f32e14c8113b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87f0ad74-183f-5d2f-86a9-2bef22f03c7e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517476Z", "modified": "2026-07-27T01:08:14.517476Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--e922212d-ad07-5691-ba4f-6e8732f05d7c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--140f72b4-3456-58ed-a3bc-67cfdbf5645b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517625Z", "modified": "2026-07-27T01:08:14.517625Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--28b6c08f-ec19-52af-bbc6-323022290344", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72ea5f2a-2a57-5b7b-841e-8d8869b7de0b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517746Z", "modified": "2026-07-27T01:08:14.517746Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--65056a35-8395-500b-b4b4-e18c583cc662", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2652dd8a-e06b-5236-bdf0-915fc9f6ab33", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.51786Z", "modified": "2026-07-27T01:08:14.51786Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--f1e0485e-29a6-584d-89dc-12506a23cfaf", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dfd5e6ef-c0d1-58cc-8485-136b3b79dff6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.517994Z", "modified": "2026-07-27T01:08:14.517994Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--caca3d01-9c70-59f4-a0c9-0a51e6b85a48", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3434b48b-b7bd-5041-943c-f50d9b52b636", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.518176Z", "modified": "2026-07-27T01:08:14.518176Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--a219883e-344b-5bba-8a47-e4e705dbe405", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4e0956b9-3faa-5105-8dfd-d38ae5b89a08", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.518337Z", "modified": "2026-07-27T01:08:14.518337Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--2a1646c2-9dc1-5357-98d7-9379fc8b4f34", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--12eb2a25-44b5-54a4-ad0e-6f960b4a32d2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.518473Z", "modified": "2026-07-27T01:08:14.518473Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--520d1984-695b-51ce-b00a-3e3135c35cd8", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b83dc7d0-535b-5706-a8c6-037f363962fe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.518591Z", "modified": "2026-07-27T01:08:14.518591Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--df0f8d62-a1bc-5461-b9e7-46d95e61cfd9", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ce8fa35-f73c-59c0-beac-5773254d356d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.518744Z", "modified": "2026-07-27T01:08:14.518744Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--5a2d92d0-087b-541c-82a5-15581b72a481", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d8efba92-bfab-57ae-86a7-847699f4e7b6", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.518876Z", "modified": "2026-07-27T01:08:14.518876Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--8cc40458-014d-5002-a2c5-55c1f5d3cc18", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2ab9cc1-f10b-578c-a4a2-31dfc7a18600", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519039Z", "modified": "2026-07-27T01:08:14.519039Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--7d3a3c89-07ac-5bfe-831d-2b1a1d327ab7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c10ea5f-a1c0-5acc-ad75-a7eae9eba04f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519192Z", "modified": "2026-07-27T01:08:14.519192Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--5486332c-9401-5bc4-a162-e9f49598ef32", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4734b09-1019-5c45-a9b5-8701c03f1967", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519297Z", "modified": "2026-07-27T01:08:14.519297Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--21894871-ad5b-5623-b92c-7b412e83f3b4", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b03e1fab-14a3-5c1f-98c8-6882c76f34a4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519395Z", "modified": "2026-07-27T01:08:14.519395Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--f6338217-0ec1-57c0-9aed-6cc872b42878", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--61f62f87-27ca-508a-93bc-cbd63737fc2d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519492Z", "modified": "2026-07-27T01:08:14.519492Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--a60085d8-c069-5b64-8f6f-6f9ab8001b67", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--97b6c53b-6c96-58b5-8652-73f575bafd26", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519587Z", "modified": "2026-07-27T01:08:14.519587Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--c72addcc-ebc0-5507-b571-fb3eb42c226f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--34bc9b60-c981-55d7-8616-5b5d179d1e59", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519681Z", "modified": "2026-07-27T01:08:14.519681Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--42f9a4f6-47f8-58c9-9611-67ad0e1f36fd", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9113f640-cd51-5072-b5aa-305ed31960e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519776Z", "modified": "2026-07-27T01:08:14.519776Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--cd537e09-2c05-5363-aca8-9815db855b0a", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--290c4779-65da-5cef-a620-547587bf785f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519874Z", "modified": "2026-07-27T01:08:14.519874Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--5a31e7dd-678b-5b19-9d7d-883cc6d7aae2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f23ed610-6126-5466-a4f7-49324d22b759", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.519968Z", "modified": "2026-07-27T01:08:14.519968Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--18d4b1be-01f3-5fca-b823-ae658bb39c7f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2db0aa32-bdc5-5f3f-839c-410b9c407e5f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520063Z", "modified": "2026-07-27T01:08:14.520063Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--0266b609-212c-51c3-8cd3-b86076fb1928", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bc303413-157b-5ff5-a181-87be14605dec", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520158Z", "modified": "2026-07-27T01:08:14.520158Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--a0463eb4-115b-5f75-bd64-dfef32e5b594", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8c7e76e-b9a3-5f19-8420-7cb5e7aa8106", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520252Z", "modified": "2026-07-27T01:08:14.520252Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--35ecda6c-00db-5ad3-accd-053e177c9c35", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1370391d-08c0-5b5f-a1eb-a7bba4d7baf2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520358Z", "modified": "2026-07-27T01:08:14.520358Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--3131185c-24a9-5f4b-9e48-23643bc13f31", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1eb357b3-667f-56ca-866a-4a5bcad4d157", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520465Z", "modified": "2026-07-27T01:08:14.520465Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--e2e52ae2-2634-51f4-b55d-87db31b69c0f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f2e602c-2c5d-59ab-a229-6d6857d4b13d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520593Z", "modified": "2026-07-27T01:08:14.520593Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--f4ae2117-1ef9-523b-8a77-234922b170b2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e93a787-595a-5e80-a726-1f1541b630a2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.52069Z", "modified": "2026-07-27T01:08:14.52069Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--b2e52178-3dd8-52d5-930a-696ca5278cba", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7aaf5800-3843-5c97-920b-130d6a033e42", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520789Z", "modified": "2026-07-27T01:08:14.520789Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--6731a2b5-ad6c-5729-b1fb-6ca9022acd90", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7326d740-b2ad-5e73-8974-772fd7f16213", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.520883Z", "modified": "2026-07-27T01:08:14.520883Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--db53095e-2d64-52d2-9215-517845954f76", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb9868ef-26b1-5548-8b4d-a7adec6a3d8b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.52098Z", "modified": "2026-07-27T01:08:14.52098Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--120e1be8-66e7-513a-808f-419e97003772", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa010cab-1709-5bff-ac05-e175e877a966", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521074Z", "modified": "2026-07-27T01:08:14.521074Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--9871b17b-c8a9-5f31-aafb-a889c677b281", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4b4c219-7619-5a77-95d2-a0af4091184d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521168Z", "modified": "2026-07-27T01:08:14.521168Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--bb7e063d-937f-52e0-8c59-3be4134985e1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7d638be-1f67-557d-89e1-1a5376de6fc2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521264Z", "modified": "2026-07-27T01:08:14.521264Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--f5e0cd61-3454-5894-9856-b5c01f1f464c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9832027-cf0e-5552-a1a9-763fab9b77d4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521359Z", "modified": "2026-07-27T01:08:14.521359Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--01bad0ab-9f55-51f1-8b5c-2b414b172714", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f03080af-9387-5122-9b02-521f2090c8f5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521456Z", "modified": "2026-07-27T01:08:14.521456Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--a544493e-970f-5e1f-921a-48ff5adc5735", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28c4a5c7-61ff-5246-a368-ef9a8c072aaa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521551Z", "modified": "2026-07-27T01:08:14.521551Z", "relationship_type": "related-to", "source_ref": "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "target_ref": "tool--a20b1e42-ab5e-5e85-866a-e1160c02ed85", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--f600aa39-9356-5b94-8a65-4b8d27c6ba2e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-07-27T01:08:14.521775Z", "modified": "2026-07-27T01:08:14.521775Z", "name": "GOCLOUD: A Commodity Cryptojacking Operation, Captured Whole", "description": "Two-node commodity cryptojacking operation bound by a shared FOFA API key and Monero wallet. THIRD-PARTY VICTIM INDICATORS ARE DELIBERATELY WITHHELD from this published feed (heartbeat-confirmed mining hosts, the Redis-verified host, and the hardcoded Jenkins re-attack targets are routed to a CERT-disclosure track, not the public feed). An operator account-identifier string paired with the FOFA key is also withheld: it traces to an unrelated third party's published tooling and is assessed as copied residue, not operator identity, so the finding is published without naming the person. The FOFA key VALUE is retained as an operator IOC. Excluded as non-operator: experimentaldumain.com and all historical domain resolutions on node 1 (prior-tenant recycled-IP artifacts; this is a pure raw-IP operation). The node-2 /xmrig ELF is the stock XMRig Linux binary; ignore any Mirai tag as a loose-signature false positive.", "report_types": [ "threat-report" ], "published": "2026-07-26T00:00:00Z", "object_refs": [ "ipv4-addr--4b71d564-32d7-556a-803e-bd7ef551da93", "indicator--062fdbcf-73ce-56c8-abb2-1031444f5507", "ipv4-addr--556c62ae-9de8-5bb6-978a-d7dc2b0b7b75", "indicator--ebacba11-f06a-5b8e-a4f4-86a52ea8796e", "url--69fceb3b-31f5-58d9-8ff6-95f1903ff6a5", "indicator--6d6c54df-04a6-5c52-8ad3-736345eef715", "url--9dccdcc1-15ea-5034-85d2-32a6bfee7195", "indicator--789e9b4c-8105-5f2d-a1c4-ae7750a15876", "url--f59d3818-cd2d-53a1-b821-537812548714", "indicator--8b13c7e4-d123-54b8-a378-c42be0ea2487", "url--c63162c7-fa4e-599e-857e-e0c01341a73d", "indicator--f0625c74-2d57-5795-a2bf-6dbc60dd3711", "url--b38ca17b-d149-54d5-9221-e5e2cbbae7be", "indicator--bfdfee33-a0c0-5ab9-8dae-fb2fb3e6dda0", "url--52d6a7d6-d5c1-5e5d-960a-724aed7a6998", "indicator--01a00eee-856e-59b9-a983-d58010a28943", "url--b43f60ac-9948-5924-b762-50acc0643d0b", "indicator--416d8066-9af3-5e3a-873b-1ffeeec7e4f8", "url--1eb51c26-4949-5de8-8c16-c7d2169d5932", "indicator--da672148-f496-50d3-bf8e-cb66fab40052", "url--e2a141b8-0aab-54fb-bd8d-5b2280a24673", "indicator--d745861e-9414-5de2-a87b-9d213438492b", "domain-name--73087b89-df73-57b6-8b83-19d276c39d28", "indicator--4ba05cb5-2063-59d1-8c76-2a9f0848f359", "domain-name--e87dbbef-6b5f-50dd-8c69-3522616eea5d", "indicator--5f26c492-8724-512d-a7ad-44db108d7668", "domain-name--404c360e-cfa0-5cdb-8006-56025ca29ce8", "indicator--d4d07e30-7e3f-5666-9f5e-6e5c935ddc7d", "domain-name--8048475d-f33a-5f54-b16d-077e2703c8ce", "indicator--e36f27e6-ae4b-5f74-8405-1d929be77cc6", "file--666d2217-344d-5c81-9f9f-695d4e47e261", "file--10e9172c-ed57-5346-9920-778f892dd537", "file--7969d345-bb03-5fce-92a9-16ec9f640058", "file--f2e2956f-33a4-508e-b4b3-93ff6eb76fd3", "file--baaa4768-1bdd-52be-81c7-da8678fcdb41", "file--a574ae0b-b651-5d4d-bdf5-1e217b27d7d8", "file--46543f5e-2acf-5317-896f-5c33869ff8e7", "file--71b5dcb6-909a-57c8-b2fd-213b50daf4e2", "file--971968af-e5c5-5089-a49c-577895bdd5bc", "file--8aea236c-ee2c-5a4b-8cc0-b1d7fc2c6c8d", "file--76e4c293-1566-5515-9703-8342cdd9c98d", "file--fce67db7-a003-5205-91ee-388b7a581d12", "file--3ef09793-26cf-5c78-9ec1-877645da1411", "file--c156efb6-9d45-5922-8f45-7e8cbe046bd8", "file--6f81811d-7012-580f-84f5-9d22fd427127", "file--43854ce9-f77d-5a48-aa46-7c0dc08016d2", "file--af054ca0-335f-587f-a22d-7bfb05e6f081", "file--3d9d9491-6984-52f0-874c-d070872d66ed", "file--8cb17335-f63c-5ff7-b830-7c609d42833c", "file--b05a8598-ffe6-5f2f-b805-6244ccee1b21", "file--155dfb5c-753a-5ce5-9b2a-89027bd54046", "file--bea61bd8-abc5-5ec6-93fd-2de8ac806f04", "file--ea4dd2df-652c-5413-b4cc-f9b2dc97a89c", "file--9f3746d3-fb8f-5879-8ccf-a64efd959faa", "file--bdde0196-d4e7-545d-ae2f-c47f53e4a89c", "file--861e9ec9-4d74-5637-a0d2-f6a4193094ea", "file--a07d7810-fe51-5f68-8616-35597d101a53", "file--ba876101-a4c8-5a58-8dd4-f39dc1669d63", "file--0cfc9fe0-341f-5d90-a310-54840b13d1d1", "file--3f66710f-6889-5333-a7fc-5124ff6f9608", "file--a5abc2e3-0df8-5365-a086-6d11d351a3b8", "file--660435f8-91c0-5830-8222-97eeac226590", "file--37a43bb7-f92c-5114-a57b-44ed6ff2d532", "file--3ff77666-08fa-560b-bcf7-b9645a97619d", "file--f34c0c89-33f7-54dd-b949-21ec33db876f", "file--11ca896f-d19d-521d-bf4f-3c09314e476b", "file--38cf0da3-7583-5386-811c-1e4da10e884d", "file--6d1922a9-13f1-556a-9fd6-9c9731678773", "file--cb61a78b-d110-57bf-a2cf-05c0c382801d", "file--6d31f319-6c53-5dae-8616-0817338a0a32", "file--07b53740-fd6a-58e9-8c32-37772ec92c05", "file--449be8e9-1d63-51b2-bac7-1e10844213d6", "indicator--fd2f5b58-8411-5874-a9a3-fe8d5f1271a5", "indicator--168dc883-1d93-5ba9-bad9-937122a62137", "indicator--2499b0e1-3893-5e8d-a19c-fb3791f619bb", "indicator--ca3de1fd-2477-5cf5-82ea-90a25897c375", "indicator--25efeb92-5d0d-5adc-93ac-6e35a3c8578a", "indicator--d36c8055-09c3-5542-a8f8-653728f43ca4", "indicator--e686fb10-dd74-5606-9ae8-74c768796823", "indicator--b449a6e9-9f27-5a0e-8ddf-5934bf3e6321", "indicator--0f7d4ae9-b9bc-55be-a830-02ecbebcc3eb", "indicator--ed8ccdde-637f-571a-9349-7c54001be07f", "indicator--c96b1632-7109-53b3-9333-aae5c669cef7", "indicator--69624b26-ddb7-555a-a0dc-5cbfaf233859", "indicator--2d02470b-a68c-532c-92f6-3ac09efc5dd2", "indicator--54c6112b-8816-5781-986a-aff4b91f07eb", "indicator--034f63c5-3132-5ce1-a5cb-b9d6698e5bfb", "indicator--a555180b-c1db-56b3-b785-b87da35394fa", "indicator--b64fcb2d-57d7-5392-b7c7-49e11bc0216d", "indicator--d91192d9-30ee-5c28-b008-42e9f56f223f", "indicator--5b834d23-9a70-5d36-bf5e-1842912f2618", "indicator--d178d71c-8029-56f0-8ac9-a37f3a836dbf", "indicator--f6fe3723-bb2d-56c7-ab13-4ae2d9a2a5d4", "indicator--e43341c8-6d6b-5d5d-9af7-3971faef1e0b", "indicator--7f568619-17e8-5781-a73b-30e61042eb4e", "malware--74c85a22-5f9a-56b5-b198-94f970b42fb8", "malware--ce133aa8-760d-57e9-95b6-3200d54d267e", "malware--ec5617d2-285c-5f43-8524-b7f3483e5179", "tool--64a34cd2-5302-5a5a-9ff0-4c86e53b1528", "tool--fccad669-7f51-5f32-962d-9ad2db5848b1", "tool--aba2a464-e2cd-5689-90ce-5f7dc1c803d8", "tool--1ce3162d-e168-55cf-a77e-ea31b270c8dc", "tool--469cd010-0062-59c9-9fc8-f32e14c8113b", "tool--e922212d-ad07-5691-ba4f-6e8732f05d7c", "tool--28b6c08f-ec19-52af-bbc6-323022290344", "tool--65056a35-8395-500b-b4b4-e18c583cc662", "tool--f1e0485e-29a6-584d-89dc-12506a23cfaf", "tool--caca3d01-9c70-59f4-a0c9-0a51e6b85a48", "tool--a219883e-344b-5bba-8a47-e4e705dbe405", "tool--2a1646c2-9dc1-5357-98d7-9379fc8b4f34", "tool--520d1984-695b-51ce-b00a-3e3135c35cd8", "tool--df0f8d62-a1bc-5461-b9e7-46d95e61cfd9", "tool--5a2d92d0-087b-541c-82a5-15581b72a481", "tool--8cc40458-014d-5002-a2c5-55c1f5d3cc18", "tool--7d3a3c89-07ac-5bfe-831d-2b1a1d327ab7", "tool--5486332c-9401-5bc4-a162-e9f49598ef32", "tool--21894871-ad5b-5623-b92c-7b412e83f3b4", "tool--f6338217-0ec1-57c0-9aed-6cc872b42878", "tool--a60085d8-c069-5b64-8f6f-6f9ab8001b67", "tool--c72addcc-ebc0-5507-b571-fb3eb42c226f", "tool--42f9a4f6-47f8-58c9-9611-67ad0e1f36fd", "tool--cd537e09-2c05-5363-aca8-9815db855b0a", "tool--5a31e7dd-678b-5b19-9d7d-883cc6d7aae2", "tool--18d4b1be-01f3-5fca-b823-ae658bb39c7f", "tool--0266b609-212c-51c3-8cd3-b86076fb1928", "tool--a0463eb4-115b-5f75-bd64-dfef32e5b594", "tool--35ecda6c-00db-5ad3-accd-053e177c9c35", "tool--3131185c-24a9-5f4b-9e48-23643bc13f31", "tool--e2e52ae2-2634-51f4-b55d-87db31b69c0f", "tool--f4ae2117-1ef9-523b-8a77-234922b170b2", "tool--b2e52178-3dd8-52d5-930a-696ca5278cba", "tool--6731a2b5-ad6c-5729-b1fb-6ca9022acd90", "tool--db53095e-2d64-52d2-9215-517845954f76", "tool--120e1be8-66e7-513a-808f-419e97003772", "tool--9871b17b-c8a9-5f31-aafb-a889c677b281", "tool--bb7e063d-937f-52e0-8c59-3be4134985e1", "tool--f5e0cd61-3454-5894-9856-b5c01f1f464c", "tool--01bad0ab-9f55-51f1-8b5c-2b414b172714", "tool--a544493e-970f-5e1f-921a-48ff5adc5735", "tool--a20b1e42-ab5e-5e85-866a-e1160c02ed85", "attack-pattern--4f83db55-e9f1-5071-aef3-ab98216b533a", "attack-pattern--7117772d-e0a9-526c-9a08-e1392a460b46", "attack-pattern--6214841b-936d-5da2-b5c8-4bed4cf9aee0", "attack-pattern--4efef37e-c256-5987-a1b8-60d9424c7250", "attack-pattern--99faa775-7366-5b35-9527-17f7643bc506", "attack-pattern--86d4700a-0ebb-52fb-9fdf-88224c58f7b6", "attack-pattern--e501c3ae-1dc5-5be4-9bdf-df96479c04e1", "attack-pattern--43404a42-9dbf-5b19-a941-1fae6c633dfe", "attack-pattern--1635f86c-b5b5-5339-b31b-87ce05013408", "attack-pattern--c6920460-6697-5d18-8569-ca30c39598fa", "attack-pattern--ef3ac7d9-a40e-539b-9435-17e7305a5bb8", "attack-pattern--c9653036-cc40-5cbd-a547-4af6331fb026", "attack-pattern--8e7236ae-f640-50d6-b963-93fae62071c7", "attack-pattern--cc6d980d-90ed-5d01-8d37-5b0b10b644c7", "attack-pattern--ae605b9d-aec8-5001-87c6-c60e0a234712", "attack-pattern--2f3dfb17-f0fc-5e2c-a404-df8df1f2d0e6", "attack-pattern--f581a47e-a604-559a-95cf-25f070a98c95", "attack-pattern--b1f2e4be-8bd7-50f4-9b12-8ff5a814d239", "attack-pattern--44bf0bb6-4445-5791-9daa-2c0a12978bf7", "attack-pattern--b0461f21-7402-55c8-89a8-87f0a8c2dacf", "attack-pattern--6036def8-6bae-5d6e-b2e5-4e5f8419e3ac", "infrastructure--786f5ee4-f1f0-559b-9cb4-541a82a9ac3d", "vulnerability--d910e8b9-3154-51d6-bf1c-cf8f2611357d", "vulnerability--1d094909-f151-5c5f-be97-7b0512521de3", "relationship--db27553e-d985-5f68-88b9-7a6dacc7b846", "relationship--34ed229b-0c95-5802-a856-f66caf7602c0", "relationship--05dee4ab-65b7-543b-be3c-77653b1f6ac8", "relationship--8ecb483e-a1eb-5640-b3a5-7e2309e93c35", "relationship--7088183f-fe94-58ab-860c-0e0d91f6c7e8", "relationship--80220add-3ade-5546-b4fc-cbf187696062", "relationship--23f7532b-cd63-56e2-a2a1-8545f520b3da", "relationship--f31fe43f-a43d-521e-98e8-08d73dacf1e8", "relationship--e6107d98-794c-5097-a902-c2a77f299d47", "relationship--e2d7dc2b-5027-597f-9545-adfb80c9fbea", "relationship--0842771c-0c50-59ce-a131-2294f9f4a96b", "relationship--ece96cf8-9102-5117-a882-2d1a13a6040f", "relationship--26ad510a-c5ee-5234-a8aa-77198134d72d", "relationship--07f87e54-1218-5ffe-91a3-7eba0601a48a", "relationship--67bc64aa-d354-5afc-80a5-4f55483536f5", "relationship--cb35ef06-e2c4-5157-8cd2-e79c99aca1f2", "relationship--a1d7cce1-1afd-5931-9bb9-5cc28c791793", "relationship--fc6c9080-0ba1-5e42-8014-5122abf5533e", "relationship--88c4f3fa-e70e-5bb4-80b0-d7f4402d4454", "relationship--f79f2e53-94a9-5a06-8bba-7ff8853bc735", "relationship--62a77a0a-d8a3-5c48-b54f-a028466f5b57", "relationship--f398c6e4-55b0-582d-94c2-edc6f905eb28", "relationship--e79e5138-e385-534c-8291-2b37787e17af", "relationship--46f66bd9-a50d-5ab4-94af-2698b93d7a2a", "relationship--33a0a865-bc2e-551b-9155-e9e8567aa6aa", "relationship--23b41aac-4cb0-5e28-9938-3f39db9138c9", "relationship--5cceca8d-eb0b-5674-97f7-57e16b232280", "relationship--2300c53c-d443-5389-894d-986506a0d2bf", "relationship--49e7a099-bb2c-51d1-bb29-3aee2fed08f0", "relationship--c2f3c94e-2191-58b4-acbf-e52b83c60313", "relationship--4b6553af-82a6-529a-b2de-7c3e73684020", "relationship--24fa2c7f-a4b6-52ca-8b00-e0ce85e714ed", "relationship--59a12dd8-fa60-59d0-9709-c1432aa21bf0", "relationship--5971035e-f698-5e5c-aeab-ed0c62390381", "relationship--346e5fe5-6ced-5d2e-9f3d-66fb94efca1f", "relationship--d64333ff-ab08-5b22-8cea-d6579ab0e39e", "relationship--f50e6f32-27d2-5054-b7aa-a023af486a2f", "relationship--6ff2d1dd-f8f7-5436-8adb-88b7e18d417f", "relationship--264b406a-798b-54aa-b601-b5efbc393127", "relationship--1901a592-7212-5e82-aa30-b453af19f4cf", "relationship--fdcb6a91-2bc0-5d16-9b73-b608e0fcd05b", "relationship--3451cea5-9e8e-535a-919e-bc907930c90e", "relationship--60e7843a-2dbf-533a-93ee-eb16d870ec7f", "relationship--9e803f90-32c1-58c0-b791-793f1269a797", "relationship--2d57cadd-80ef-5b14-86dc-35dca0555c4c", "relationship--160fb2b6-89e1-574e-9a25-4c3295819f9d", "relationship--6ef7c769-b100-5b97-94dc-e4ac439219a0", "relationship--4b6a8371-c354-5f5d-bc3b-a66c07e6fdee", "relationship--b2e2d500-8534-5d85-a063-6ba97adcfe85", "relationship--ee18f83a-0d67-5d91-a4d1-9e0b1b29b31d", "relationship--f6e490e7-9a78-5d90-9325-90d96a1395c1", "relationship--eed7c904-bd87-55d0-b2dc-65852f464a58", "relationship--e058a03b-6c26-507c-9652-fed3c570e748", "relationship--80f8337e-3755-564a-a003-84c8e47591f1", "relationship--df919a44-f2ea-5aa3-9970-9bf6e5708417", "relationship--595ac730-1966-5b33-b217-3d7f3788f779", "relationship--02d76b35-1f68-5014-9ffe-4ca5c6b4becf", "relationship--ddae8b34-1278-521a-bc93-5dd5ad62d73d", "relationship--eb33bf1f-09b3-503f-882c-53dce212bc3c", "relationship--9abf94a1-345a-5efc-93c5-9bd1f6f86264", "relationship--d5461aa3-c4fd-5708-90ec-5e7bf9f3faae", "relationship--4876feaa-bba3-56f2-a675-2cef86e923f9", "relationship--7d2fb29f-3c62-5d64-b102-707630cdb1f0", "relationship--b223fa2e-4bcf-5be3-8f05-ea70fbdb48f2", "relationship--d320cdff-9e68-58bc-8ee7-36558d52fda3", "relationship--ddccda51-b4a7-53c2-a57d-b65d492fda3a", "relationship--f337a51f-f2bc-5ba0-a86d-5072d36a809a", "relationship--9522cd58-84bf-58ec-8b70-0bc654cece07", "relationship--765bc371-8d45-5027-84b6-8aa5646104b5", "relationship--c5eebf64-b691-5648-99b2-c5339a62211c", "relationship--abfc1ad1-13a3-5503-8070-0d2383df46e0", "relationship--b867f010-0988-59a3-8121-75270318240c", "relationship--0d2f6e86-60e6-5367-9494-5e4c6f607aba", "relationship--ec36935b-65c1-57c7-bfe9-1c8b172a5f56", "relationship--fa953146-4a2e-5618-a5ef-d88c502f64b3", "relationship--68509ca9-5cd6-5a11-ab7c-7302f0e03f5f", "relationship--b4a3f5c2-6eea-511c-bd5a-d939125f0749", "relationship--296ebb31-1b36-5326-a2b4-6191e4b169d7", "relationship--197df16f-0bbe-5c17-be1c-9a3e2f8c4e6d", "relationship--0ce3b834-21dc-5218-853e-e1a6c2eccc41", "relationship--3b836610-1ef5-5930-a10f-f32d0eec5911", "relationship--778dcf5f-910d-59dd-b200-3e54c4294773", "relationship--373396e2-7ba2-57bb-8caa-08f6094e6e80", "relationship--e3872246-e300-5f94-abbe-48d7b264c9f3", "relationship--dccaf3c9-68fe-5516-ba4e-187bde66a892", "relationship--d5cab3fd-3d37-5cd3-8ce5-46c0752e6615", "relationship--827258fa-2057-56b3-b243-754ce0996788", "relationship--93bccbb5-4583-5e93-be82-3d00d0c8c9a1", "relationship--c38ac1f7-96fe-574f-9c6b-dd0da3eb5e4f", "relationship--452392d6-e5e2-5b83-9511-601026b210af", "relationship--d6f8daa1-0d37-5c89-99a7-87d0baba784c", "relationship--09c4b9d5-5e59-58e3-9b71-516ec5c4f134", "relationship--83c16930-8f88-5a6f-b797-ef7ae26e612c", "relationship--8a7a9eb0-25d5-5c7a-9c7c-c827a88cf9df", "relationship--9df98fb0-3068-5367-9b42-0a5c3fdc59a3", "relationship--cd9657d6-1212-57eb-aa54-315901628d63", "relationship--3f1b8d9c-6696-5822-842b-47898205db2c", "relationship--42e2a320-9ba1-5c65-aa9c-a0d85701cbc0", "relationship--1d423ada-a517-5b58-82ea-425459d98e10", "relationship--323c6349-0ece-55e8-b1ab-33021f0bd375", "relationship--f0a49d80-b67e-52f8-bb89-c831a6696715", "relationship--27e77843-1b45-53d3-a9f4-c749b81ad4f1", "relationship--51ff09d2-8c74-509d-b49a-93d7474b7f04", "relationship--cc37c297-6b2e-5b28-a92f-f66b1caf1cb2", "relationship--05988263-2442-5442-85bd-d8afd87f1e4a", "relationship--95877d2f-8df5-5438-995e-ee656a046898", "relationship--d9a1c8b3-3e9d-5b1e-81c5-cc662e2eecf0", "relationship--9e9650ca-e779-5f97-a2c1-bae199447bf1", "relationship--3e263af5-e571-5d1a-bad6-141df635f0c5", "relationship--d6bea67d-af9e-5c05-bcef-c2d6fc69eceb", "relationship--dae5c842-d8b2-5eda-a07f-174f426ad84d", "relationship--c9902469-a14c-54c8-b38a-e37259415cfc", "relationship--bfeeea9e-1b64-5e73-8626-f201c8b6312c", "relationship--49e93cce-ef26-5321-842c-aad013860d22", "relationship--276c9d6c-d8d0-5aba-8bac-f680ea0ab4d3", "relationship--87f0ad74-183f-5d2f-86a9-2bef22f03c7e", "relationship--140f72b4-3456-58ed-a3bc-67cfdbf5645b", "relationship--72ea5f2a-2a57-5b7b-841e-8d8869b7de0b", "relationship--2652dd8a-e06b-5236-bdf0-915fc9f6ab33", "relationship--dfd5e6ef-c0d1-58cc-8485-136b3b79dff6", "relationship--3434b48b-b7bd-5041-943c-f50d9b52b636", "relationship--4e0956b9-3faa-5105-8dfd-d38ae5b89a08", "relationship--12eb2a25-44b5-54a4-ad0e-6f960b4a32d2", "relationship--b83dc7d0-535b-5706-a8c6-037f363962fe", "relationship--8ce8fa35-f73c-59c0-beac-5773254d356d", "relationship--d8efba92-bfab-57ae-86a7-847699f4e7b6", "relationship--d2ab9cc1-f10b-578c-a4a2-31dfc7a18600", "relationship--1c10ea5f-a1c0-5acc-ad75-a7eae9eba04f", "relationship--c4734b09-1019-5c45-a9b5-8701c03f1967", "relationship--b03e1fab-14a3-5c1f-98c8-6882c76f34a4", "relationship--61f62f87-27ca-508a-93bc-cbd63737fc2d", "relationship--97b6c53b-6c96-58b5-8652-73f575bafd26", "relationship--34bc9b60-c981-55d7-8616-5b5d179d1e59", "relationship--9113f640-cd51-5072-b5aa-305ed31960e3", "relationship--290c4779-65da-5cef-a620-547587bf785f", "relationship--f23ed610-6126-5466-a4f7-49324d22b759", "relationship--2db0aa32-bdc5-5f3f-839c-410b9c407e5f", "relationship--bc303413-157b-5ff5-a181-87be14605dec", "relationship--f8c7e76e-b9a3-5f19-8420-7cb5e7aa8106", "relationship--1370391d-08c0-5b5f-a1eb-a7bba4d7baf2", "relationship--1eb357b3-667f-56ca-866a-4a5bcad4d157", "relationship--9f2e602c-2c5d-59ab-a229-6d6857d4b13d", "relationship--9e93a787-595a-5e80-a726-1f1541b630a2", "relationship--7aaf5800-3843-5c97-920b-130d6a033e42", "relationship--7326d740-b2ad-5e73-8974-772fd7f16213", "relationship--eb9868ef-26b1-5548-8b4d-a7adec6a3d8b", "relationship--fa010cab-1709-5bff-ac05-e175e877a966", "relationship--a4b4c219-7619-5a77-95d2-a0af4091184d", "relationship--c7d638be-1f67-557d-89e1-1a5376de6fc2", "relationship--f9832027-cf0e-5552-a1a9-763fab9b77d4", "relationship--f03080af-9387-5122-9b02-521f2090c8f5", "relationship--28c4a5c7-61ff-5246-a368-ef9a8c072aaa" ], "labels": [ "Cryptojacking", "OpenDirectory", "China" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/gocloud-multiservice-cryptojacking-149-28-112-221/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }